Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:file.exe
Analysis ID:1527956
MD5:6d09b95cc7d01afe4997af5e6e550580
SHA1:4d1727ef778c9516274e0beb383c22b1282382fa
SHA256:ca2858de41af6f9b91bafd74fbb004bf30a313701f14118406f091822f9ae635
Tags:exeuser-Bitsight
Infos:

Detection

Credential Flusher
Score:64
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Yara detected Credential Flusher
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
Found API chain indicative of sandbox detection
Machine Learning detection for sample
Contains functionality for read data from the clipboard
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Detected non-DNS traffic on DNS port
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
OS version to string mapping found (often used in BOTs)
Potential key logger detected (key state polling based)
Sample execution stops while process was sleeping (likely an evasion)
Sleep loop found (likely to delay execution)
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Uses taskkill to terminate processes

Classification

Process Tree

  • System is w10x64
  • file.exe (PID: 7264 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 6D09B95CC7D01AFE4997AF5E6E550580)
    • taskkill.exe (PID: 7280 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)
      • conhost.exe (PID: 7288 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • taskkill.exe (PID: 7344 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)
      • conhost.exe (PID: 7352 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • taskkill.exe (PID: 7408 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)
      • conhost.exe (PID: 7416 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • taskkill.exe (PID: 7472 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)
      • conhost.exe (PID: 7480 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • taskkill.exe (PID: 7536 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)
      • conhost.exe (PID: 7544 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • chrome.exe (PID: 7624 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 7832 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2016 --field-trial-handle=1936,i,4378290034050703555,17962560962937059959,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 7572 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5500 --field-trial-handle=1936,i,4378290034050703555,17962560962937059959,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 7588 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 --field-trial-handle=1936,i,4378290034050703555,17962560962937059959,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
Process Memory Space: file.exe PID: 7264JoeSecurity_CredentialFlusherYara detected Credential FlusherJoe Security

    Sigma Signatures

    ⊘No Sigma rule has matched

    Suricata Signatures

    ⊘No Suricata rule has matched

    Joe Sandbox Signatures

    Click to jump to signature section

    Show All Signature Results

    AV Detection

    barindex
    AI detected suspicious sample
    Source: Submited SampleIntegrated Neural Analysis Model: Matched 98.4% probability
    Machine Learning detection for sample
    Source: file.exeJoe Sandbox ML: detected
    Source: file.exeStatic PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
    Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49742 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49745 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.4:49769 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49784 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.4:49794 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49796 version: TLS 1.2
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F1DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,0_2_00F1DBBE
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F268EE FindFirstFileW,FindClose,0_2_00F268EE
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F2698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,0_2_00F2698F
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F1D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_00F1D076
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F1D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_00F1D3A9
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F29642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00F29642
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F2979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00F2979D
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F29B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,0_2_00F29B2B
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F25C97 FindFirstFileW,FindNextFileW,FindClose,0_2_00F25C97
    Source: global trafficTCP traffic: 192.168.2.4:62887 -> 1.1.1.1:53
    Source: Joe Sandbox ViewIP Address: 239.255.255.250 239.255.255.250
    Source: Joe Sandbox ViewJA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
    Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.32
    Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
    Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
    Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
    Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
    Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
    Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
    Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
    Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
    Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
    Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
    Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
    Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
    Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
    Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
    Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
    Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
    Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
    Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
    Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
    Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
    Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
    Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
    Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
    Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
    Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
    Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
    Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
    Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
    Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
    Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
    Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
    Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
    Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.45
    Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.45
    Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.45
    Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.45
    Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.45
    Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.45
    Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.45
    Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.45
    Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.45
    Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.45
    Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.45
    Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.45
    Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.45
    Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.45
    Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.45
    Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.45
    Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.45
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F2CE44 InternetReadFile,SetEvent,GetLastError,SetEvent,0_2_00F2CE44
    Source: global trafficHTTP traffic detected: GET /account?=https://accounts.google.com/v3/signin/challenge/pwd HTTP/1.1Host: youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
    Source: global trafficHTTP traffic detected: GET /account?=https%3A%2F%2Faccounts.google.com%2Fv3%2Fsignin%2Fchallenge%2Fpwd HTTP/1.1Host: www.youtube.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
    Source: global trafficHTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
    Source: global trafficHTTP traffic detected: GET /accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=-528144849&timestamp=1728300193684 HTTP/1.1Host: accounts.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-wow64: ?0sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: iframeReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
    Source: global trafficHTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
    Source: global trafficHTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=VHV8A9Yd+22nUsD&MD=9zWC1dr4 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
    Source: global trafficHTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=VHV8A9Yd+22nUsD&MD=9zWC1dr4 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
    Source: global trafficHTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: chromecache_149.13.drString found in binary or memory: _.iq(p)+"/familylink/privacy/notice/embedded?langCountry="+_.iq(p);break;case "PuZJUb":a+="https://www.youtube.com/t/terms?chromeless=1&hl="+_.iq(m);break;case "fxTQxb":a+="https://youtube.com/t/terms?gl="+_.iq(_.rq(c))+"&hl="+_.iq(d)+"&override_hl=1"+(f?"&linkless=1":"");break;case "prAmvd":a+="https://www.google.com/intl/"+_.iq(m)+"/chromebook/termsofservice.html?languageCode="+_.iq(d)+"&regionCode="+_.iq(c);break;case "NfnTze":a+="https://policies.google.com/privacy/google-partners"+(f?"/embedded": equals www.youtube.com (Youtube)
    Source: global trafficDNS traffic detected: DNS query: youtube.com
    Source: global trafficDNS traffic detected: DNS query: www.youtube.com
    Source: global trafficDNS traffic detected: DNS query: www.google.com
    Source: global trafficDNS traffic detected: DNS query: accounts.youtube.com
    Source: global trafficDNS traffic detected: DNS query: play.google.com
    Source: unknownHTTP traffic detected: POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 1416sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"Content-Type: application/x-www-form-urlencoded;charset=UTF-8sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"X-Goog-AuthUser: 0sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*Origin: https://accounts.google.comX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=518=UwKxF1J0Ty-rCTFpiJigHwx9qSYUjdENylT2S5EBu-d7HIQNmkiBrs4abkKIikW5MuMg8y8ds6lU-LU8nv4jiRSmeAnRyNtpYQ1RYL_SOj8r5MNcOIINVzxGlKqjlDWV01cqxRWVKHaXdZjqwunWYK87d5fkyKvT0B_we7awexcXtsvmvVa4I2zfww
    Source: chromecache_149.13.drString found in binary or memory: https://accounts.google.com
    Source: chromecache_149.13.drString found in binary or memory: https://accounts.google.com/TOS?loc=
    Source: chromecache_145.13.drString found in binary or memory: https://apis.google.com/js/api.js
    Source: chromecache_149.13.drString found in binary or memory: https://apis.google.com/js/rpc:shindig_random.js?onload=credentialservice.postMessage
    Source: chromecache_149.13.drString found in binary or memory: https://families.google.com/intl/
    Source: chromecache_145.13.drString found in binary or memory: https://fonts.gstatic.com/s/i/productlogos/drive_2020q4/v10/192px.svg
    Source: chromecache_145.13.drString found in binary or memory: https://fonts.gstatic.com/s/i/productlogos/gmail_2020q4/v10/web-48dp/logo_gmail_2020q4_color_2x_web_
    Source: chromecache_145.13.drString found in binary or memory: https://fonts.gstatic.com/s/i/productlogos/maps/v7/192px.svg
    Source: chromecache_149.13.drString found in binary or memory: https://g.co/recover
    Source: chromecache_149.13.drString found in binary or memory: https://play.google.com/log?format=json&hasfast=true
    Source: chromecache_149.13.drString found in binary or memory: https://play.google.com/work/enroll?identifier=
    Source: chromecache_149.13.drString found in binary or memory: https://play.google/intl/
    Source: chromecache_149.13.drString found in binary or memory: https://policies.google.com/privacy
    Source: chromecache_149.13.drString found in binary or memory: https://policies.google.com/privacy/additional
    Source: chromecache_149.13.drString found in binary or memory: https://policies.google.com/privacy/google-partners
    Source: chromecache_149.13.drString found in binary or memory: https://policies.google.com/technologies/cookies
    Source: chromecache_149.13.drString found in binary or memory: https://policies.google.com/technologies/location-data
    Source: chromecache_149.13.drString found in binary or memory: https://policies.google.com/terms
    Source: chromecache_149.13.drString found in binary or memory: https://policies.google.com/terms/location
    Source: chromecache_149.13.drString found in binary or memory: https://policies.google.com/terms/service-specific
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/account-recovery-email-pin.gif
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/account-recovery-password.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/account-recovery-sms-or-voice-pin.gif
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/account-recovery-sms-pin.gif
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/account-recovery-stop-go-landing-page_1x.png
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/animation/
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/ble_device.png
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/ble_pin.png
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/contacts_backup_sync.png
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/contacts_backup_sync_1x.png
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/contacts_backup_sync_2x.png
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/contacts_backup_sync_darkmode_1x.png
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/continue_on_your_phone.png
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/device_phone_number_verification.png
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/device_prompt_silent_tap_yes_darkmode.gif
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/device_prompt_tap_yes.gif
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/device_prompt_tap_yes_darkmode.gif
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kid_success.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kid_success_darkmode.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidfork_who_will_use_dark_v2.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidfork_who_will_use_updated.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidfork_who_will_use_updated_darkmode.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidfork_who_will_use_v2.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignin_not_ready.png
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignin_stick_around_1.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignin_stick_around_dark_1.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_child_account_1.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_child_account_darkmode_1.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_child_privacy_1.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_child_privacy_darkmode_1.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_created.png
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_double_device.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_double_device_darkmode.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_full_house.png
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_link_accounts_1.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_link_accounts_darkmode_1.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_parent_app_decision.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_parent_app_decision_darkmode.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_parent_supervision_1.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_parent_supervision_darkmode_1.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_respect_others_1.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_respect_others_darkmode_1.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_single_device.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_single_device_darkmode.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_stop.png
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/personalization_reminders.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/phone_number_sign_in_2x.png
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/return_to_desktop.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/return_to_desktop_darkmode.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/security_key.gif
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/security_key_ios_center.png
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/security_key_laptop.gif
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/security_key_nfc_discovered.gif
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/security_key_nfc_discovered_darkmode.gif
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/security_key_phone.gif
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/signin_googleapp_ios.gif
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/signin_googleapp_pulldown.gif
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/signin_tapyes.gif
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/smart_lock_2x.png
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/usb_key.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/web_and_app_activity.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/who_will_be_using_this_device.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/you_tube_history.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/feature_not_available.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/feature_not_available_dark.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/gmail_ios_authzen.gif
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/paaskey.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_challenge.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_challenge_darkmode.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_darkmode.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_enrollment.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_enrollment_cross_device.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_enrollment_cross_device_darkmode.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_enrollment_darkmode.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_enrollment_error.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_enrollment_error_darkmode.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_enrollment_reauth.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_enrollment_reauth_darkmode.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_success.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_success_darkmode.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkeyerror.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkeyerror_darkmode.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/red_globe_dark.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/red_globe_light.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/screenlock.png
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/security_key_ipad.gif
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/security_key_iphone.gif
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/security_key_iphone_nfc.gif
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/security_key_iphone_usb.gif
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/security_key_phone.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/security_keys.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/success_checkmark_2.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/success_checkmark_2_darkmode.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/ui/loading_spinner_gm.gif
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/ui/progress_spinner_color_20dp_4x.gif
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/ui/success-gm-default_2x.png
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/apps/signup/resources/custom-email-address.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/images/hpp/shield_security_checkup_green_2x_web_96dp.png
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/chaptering/account_setup_chapter_dark_1.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/chaptering/account_setup_chapter_v1.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/chaptering/device_setup_chapter_dark_v1.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/chaptering/device_setup_chapter_v1.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/chaptering/parental_control_chapter_dark_v1.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/chaptering/parental_control_chapter_v1.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/conversion/conversion_accountslinked.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/conversion/conversion_accountslinked_dark.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/conversion/conversion_childneedshelp.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/conversion/conversion_childneedshelp_dark.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/conversion/conversion_nextstepsforparents.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/conversion/conversion_nextstepsforparents_dark.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_allset.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_allset_dark.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_apps_devices.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_apps_devices_darkmode.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_areyousurekid.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_areyousurekid_dark.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_birthdayemail.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_birthdayemail_dark.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_choose_apps.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_choose_apps_darkmode.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_confirmation.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_exploremore.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_exploremore_dark.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_intro.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_intro_darkmode.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_privacy_terms_a18.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_privacy_terms_a18_darkmode.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_privacyterms.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_privacyterms_dark.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_review_settings.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_review_settings_darkmode.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_safe_search.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_safe_search_darkmode.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_success_unchanged_a18.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_success_unchanged_a18_darkmode.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_success_update_a18.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_success_update_a18_darkmode.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_supervision_choice.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_supervision_choice_a18.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_supervision_choice_a18_darkmode.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_supervision_choice_darkmode.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_supervisiongrad.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_supervisiongrad_dark.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/guardianlinking/linking_complete_0.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/guardianlinking/linking_complete_dark_0.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/ads_personalization.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/ads_personalization_darkmode.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/confirmation.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/confirmation_darkmode.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/eligibility_error.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/eligibility_error_darkmode.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/fork.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/fork_darkmode.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/intro.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/intro_darkmode.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/personal_results.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/personal_results_darkmode.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/safe_search.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/safe_search_darkmode.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/check_notifications.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/check_notifications_dark.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/kid_watch_installing_family_link_2.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/kid_watch_installing_family_link_dark_2.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/kid_watch_set_up_location_sharing_2.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/kid_watch_set_up_location_sharing_dark_2.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/kid_watch_set_up_parental_controls_2.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/kid_watch_set_up_parental_controls_dark_2.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/kid_watch_set_up_school_time_2.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/kid_watch_set_up_school_time_dark_2.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/location_sharing_enabled_2.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/location_sharing_enabled_dark_3.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/parent_sign_in_prologue_1.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/parent_sign_in_prologue_dark_1.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/set_up_complete_1.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/set_up_complete_dark_1.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/set_up_contacts_2.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/set_up_contacts_dark_2.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/set_up_family_link_boy_1.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/set_up_family_link_boy_dark_1.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/set_up_family_link_girl_2.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/set_up_family_link_girl_dark_2.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/ulp_continue_without_gmail_dark_v2.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/ulp_continue_without_gmail_v2.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/all_set.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/all_set_dark.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/are_you_sure_parent.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/are_you_sure_parent_dark.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/content_restriction.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/content_restriction_dark.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/error.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/error_dark.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/how_controls_work.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/how_controls_work_dark.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/next_steps.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/next_steps_dark.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/setup_controls.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/setup_controls_dark.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/who_parent.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/who_parent_dark.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/who_teen.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/who_teen_dark.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/teentoadultgraduation/supervision_choice.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/teentoadultgraduation/supervision_choice_darkmode.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/ulp_appblock/kid_setup_parent_escalation.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/ulp_appblock/kid_setup_parent_escalation_dark.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/ulp_appblock/send_email_confirmation.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/ulp_appblock/send_email_confirmation_dark.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/ulp_appblock/success_sent_email.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/ulp_appblock/success_sent_email_dark.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/ulpupgrade/kidprofileupgrade_all_set.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/ulpupgrade/kidprofileupgrade_all_set_darkmode.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/all_set.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/all_set_dark.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/almost_done_kids_space_dark.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/almost_done_kids_space_v2.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/devices_connected_tablet_v2.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/devices_connected_tablet_v2_dark.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/devices_connected_v2.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/devices_connected_v2_dark.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/emailinstallfamilylink.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/emailinstallfamilylink_dark.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/familylinkinstalling.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/familylinkinstalling_dark.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/hand_over_device_dark_v2.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/hand_over_device_v2.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/linking_accounts_v2.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/linking_accounts_v2_dark.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/locationsetup.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/locationsetup_dark.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/manage_parental_controls_email.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/manage_parental_controls_email_v2.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/manage_parental_controls_email_v2_dark.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/manage_parental_controls_v2.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/manage_parental_controls_v2_dark.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/open_family_link_v2.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/open_family_link_v2_dark.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/parents_help.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/parents_help_dark.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/set_up_kids_space.png
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/set_up_kids_space_dark.png
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/setupcontrol.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/setupcontrol_dark.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/setuplocation.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/setuplocation_dark.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/setuptimelimits.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/setuptimelimits_dark.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/supervision_ready_v2.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/supervision_ready_v2_dark.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/youtubeaccess.svg
    Source: chromecache_145.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/youtubeaccess_dark.svg
    Source: chromecache_149.13.drString found in binary or memory: https://support.google.com/accounts?hl=
    Source: chromecache_149.13.drString found in binary or memory: https://support.google.com/accounts?p=new-si-ui
    Source: chromecache_149.13.drString found in binary or memory: https://support.google.com/websearch/answer/4358949?hl=ko&ref_topic=3285072
    Source: chromecache_145.13.drString found in binary or memory: https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=
    Source: chromecache_149.13.drString found in binary or memory: https://www.google.com
    Source: chromecache_149.13.drString found in binary or memory: https://www.google.com/intl/
    Source: chromecache_145.13.drString found in binary or memory: https://www.gstatic.com/accounts/speedbump/authzen_optin_illustration.gif
    Source: chromecache_145.13.drString found in binary or memory: https://www.gstatic.com/images/branding/product/2x/chrome_48dp.png
    Source: chromecache_145.13.drString found in binary or memory: https://www.gstatic.com/images/branding/product/2x/googleg_48dp.png
    Source: chromecache_145.13.drString found in binary or memory: https://www.gstatic.com/images/branding/product/2x/gsa_48dp.png
    Source: chromecache_145.13.drString found in binary or memory: https://www.gstatic.com/images/branding/product/2x/play_prism_48dp.png
    Source: chromecache_145.13.drString found in binary or memory: https://www.gstatic.com/images/branding/product/2x/youtube_48dp.png
    Source: chromecache_149.13.drString found in binary or memory: https://www.gstatic.com/images/branding/productlogos/googleg/v6/36px.svg
    Source: chromecache_149.13.drString found in binary or memory: https://www.youtube.com/t/terms?chromeless=1&hl=
    Source: file.exe, 00000000.00000003.1733203302.0000000000584000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2964510887.0000000001028000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
    Source: chromecache_149.13.drString found in binary or memory: https://youtube.com/t/terms?gl=
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49865
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49986
    Source: unknownNetwork traffic detected: HTTP traffic on port 49817 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49864
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49985
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49742
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49863
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49984
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49741
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49862
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49983
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49861
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49982
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49860
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49981
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49980
    Source: unknownNetwork traffic detected: HTTP traffic on port 49932 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49898 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49875 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49852 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49795 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49990 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49859
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49858
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49979
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49736
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49857
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49978
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49856
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49977
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49855
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49976
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49733
    Source: unknownNetwork traffic detected: HTTP traffic on port 49841 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49854
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49975
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49853
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49974
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49852
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49973
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49851
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49972
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49850
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49971
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49970
    Source: unknownNetwork traffic detected: HTTP traffic on port 49967 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 62904 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49784 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50004 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49909 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49806 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49943 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49849
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49848
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49969
    Source: unknownNetwork traffic detected: HTTP traffic on port 49978 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49847
    Source: unknownNetwork traffic detected: HTTP traffic on port 49886 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49968
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49846
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49967
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49845
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49966
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49844
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49965
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49843
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49964
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49842
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49963
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49841
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49962
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49840
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49961
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49960
    Source: unknownNetwork traffic detected: HTTP traffic on port 49966 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49989 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49828 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49933 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50028 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49805 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49839
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49838
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49959
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49837
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49958
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49836
    Source: unknownNetwork traffic detected: HTTP traffic on port 49921 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49957
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49835
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49956
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49834
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49955
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49833
    Source: unknownNetwork traffic detected: HTTP traffic on port 49887 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49954
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49832
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49953
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49831
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49952
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49951
    Source: unknownNetwork traffic detected: HTTP traffic on port 49839 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49864 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49950
    Source: unknownNetwork traffic detected: HTTP traffic on port 49944 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49910 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49853 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49796 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49955 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49829
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49828
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49949
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49827
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49948
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49826
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49947
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49825
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49946
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49824
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49945
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49823
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49944
    Source: unknownNetwork traffic detected: HTTP traffic on port 62894 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49822
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49943
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49788
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49787
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49786
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49785
    Source: unknownNetwork traffic detected: HTTP traffic on port 49922 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49784
    Source: unknownNetwork traffic detected: HTTP traffic on port 49945 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50017 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49968 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49785 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50026 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 62910
    Source: unknownNetwork traffic detected: HTTP traffic on port 49807 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49980 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49736 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49885 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49899
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49898
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49897
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49896
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49895
    Source: unknownNetwork traffic detected: HTTP traffic on port 49862 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49894
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49893
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49892
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49891
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49890
    Source: unknownNetwork traffic detected: HTTP traffic on port 49897 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49911 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49957 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49851 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 62896 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49991 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49769
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49889
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49888
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49887
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49886
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49885
    Source: unknownNetwork traffic detected: HTTP traffic on port 49863 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49884
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49883
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49882
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49881
    Source: unknownNetwork traffic detected: HTTP traffic on port 49840 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49880
    Source: unknownNetwork traffic detected: HTTP traffic on port 62905 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49896 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49797 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49956 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50005 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 62895 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49979 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49879
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49757
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49878
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49999
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49877
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49998
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49876
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49997
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49875
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49996
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49874
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49995
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49873
    Source: unknownNetwork traffic detected: HTTP traffic on port 49923 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49994
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49872
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49993
    Source: unknownNetwork traffic detected: HTTP traffic on port 50016 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49818 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49871
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49992
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49870
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49991
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49990
    Source: unknownNetwork traffic detected: HTTP traffic on port 49786 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49874 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49829 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49934 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50027 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49869
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49868
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49989
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49867
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49988
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49745
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49866
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49987
    Source: unknownNetwork traffic detected: HTTP traffic on port 50013 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49769 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49803 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49826 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 62907 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49906 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49849 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49900 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49837 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49975 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49929 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49872 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50025 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49964 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49798 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49861 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49999 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 62892 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49918 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49873 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49787 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49930 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49745 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50001 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49986 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49850 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49963 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 62891 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49799
    Source: unknownNetwork traffic detected: HTTP traffic on port 49757 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50007
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49798
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50006
    Source: unknownNetwork traffic detected: HTTP traffic on port 50012 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49797
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50009
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49796
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50008
    Source: unknownNetwork traffic detected: HTTP traffic on port 49952 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49795
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49794
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49793
    Source: unknownNetwork traffic detected: HTTP traffic on port 49814 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49792
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49791
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49790
    Source: unknownNetwork traffic detected: HTTP traffic on port 62906 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50001
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50000
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50003
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50002
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50005
    Source: unknownNetwork traffic detected: HTTP traffic on port 49895 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50004
    Source: unknownNetwork traffic detected: HTTP traffic on port 49825 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49884 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49941 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49789
    Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49997 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49859 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49871 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49894 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50003 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49965 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49799 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49942 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49977 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 62893 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49816 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50035 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49919 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49954 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50014 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49788 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49988 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49827 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 62888
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 62889
    Source: unknownNetwork traffic detected: HTTP traffic on port 62908 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49882 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49848 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49838 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49976 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49953 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49815 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 62898
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 62899
    Source: unknownNetwork traffic detected: HTTP traffic on port 49908 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50024 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49883 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49860 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 62891
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 62892
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 62893
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 62894
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 62895
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 62896
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 62897
    Source: unknownNetwork traffic detected: HTTP traffic on port 49998 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49931 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49804 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50002 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49987 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49920 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 62888 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49926 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49949 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49800 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49789 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49961 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49984 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50022 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49881 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49675 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49950 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49996 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50010 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49812 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49858 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49893 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49915 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49823 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49869 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49790 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50009 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50034 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49972 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49834 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49892 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 62899 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 62909 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49904 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49847 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49927 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49822 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49870 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49983 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49938 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50023 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49811 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50018
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50017
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50019
    Source: unknownNetwork traffic detected: HTTP traffic on port 49813 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49951 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49974 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50032 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50010
    Source: unknownNetwork traffic detected: HTTP traffic on port 49916 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49836 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50012
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50011
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50014
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50013
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50016
    Source: unknownNetwork traffic detected: HTTP traffic on port 49939 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49845 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49791 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49868 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50029
    Source: unknownNetwork traffic detected: HTTP traffic on port 62889 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 62900 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50028
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50021
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50020
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50023
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50022
    Source: unknownNetwork traffic detected: HTTP traffic on port 49742 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50025
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50024
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50027
    Source: unknownNetwork traffic detected: HTTP traffic on port 49879 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50026
    Source: unknownNetwork traffic detected: HTTP traffic on port 49985 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50000 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49802 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50021 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50030
    Source: unknownNetwork traffic detected: HTTP traffic on port 49905 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49995 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50011 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49928 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50032
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50031
    Source: unknownNetwork traffic detected: HTTP traffic on port 49741 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49857 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50034
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50033
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50035
    Source: unknownNetwork traffic detected: HTTP traffic on port 62910 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49801 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49940 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49824 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49973 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49891 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50033 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49835 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49917 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49880 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49962 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49846 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49792 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49890 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49970 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50007 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49878 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49912 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49935 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49958 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 62897 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49889 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49866 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49820 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49946 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50018 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49855 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49981 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49901 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49924 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 62901 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49819 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49844 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49947 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49793 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49831 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50031 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49992 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49969 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49994 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 62906
    Source: unknownNetwork traffic detected: HTTP traffic on port 50020 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 62907
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 62908
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 62909
    Source: unknownNetwork traffic detected: HTTP traffic on port 49856 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49913 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 62900
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 62901
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 62902
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 62903
    Source: unknownNetwork traffic detected: HTTP traffic on port 49808 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 62904
    Source: unknownNetwork traffic detected: HTTP traffic on port 50006 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 62905
    Source: unknownNetwork traffic detected: HTTP traffic on port 49867 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49821
    Source: unknownNetwork traffic detected: HTTP traffic on port 49865 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49942
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49820
    Source: unknownNetwork traffic detected: HTTP traffic on port 49842 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49941
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49940
    Source: unknownNetwork traffic detected: HTTP traffic on port 62903 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49833 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49819
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49818
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49939
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49938
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49817
    Source: unknownNetwork traffic detected: HTTP traffic on port 49810 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49816
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49937
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49815
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49936
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49814
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49935
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49813
    Source: unknownNetwork traffic detected: HTTP traffic on port 49902 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49934
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49812
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49933
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49811
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49932
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49810
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49931
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49930
    Source: unknownNetwork traffic detected: HTTP traffic on port 49925 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50008 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49971 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49794 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49936 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49876 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49960 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49809
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49808
    Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49742 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49745 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.4:49769 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49784 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.4:49794 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49796 version: TLS 1.2
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F2EAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,0_2_00F2EAFF
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F2ED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,0_2_00F2ED6A
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F2EAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,0_2_00F2EAFF
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F1AA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,0_2_00F1AA57
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F49576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,0_2_00F49576

    System Summary

    barindex
    Binary is likely a compiled AutoIt script file
    Source: file.exeString found in binary or memory: This is a third-party compiled AutoIt script.
    Source: file.exe, 00000000.00000000.1709870001.0000000000F72000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: This is a third-party compiled AutoIt script.memstr_35c65fd8-9
    Source: file.exe, 00000000.00000000.1709870001.0000000000F72000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainermemstr_c8935dfd-9
    Source: file.exeString found in binary or memory: This is a third-party compiled AutoIt script.memstr_aa644c1f-d
    Source: file.exeString found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainermemstr_bd7cccde-3
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F1D5EB: CreateFileW,DeviceIoControl,CloseHandle,0_2_00F1D5EB
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F11201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,0_2_00F11201
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F1E8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,0_2_00F1E8F6
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00EB80600_2_00EB8060
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F220460_2_00F22046
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F182980_2_00F18298
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00EEE4FF0_2_00EEE4FF
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00EE676B0_2_00EE676B
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F448730_2_00F44873
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00EBCAF00_2_00EBCAF0
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00EDCAA00_2_00EDCAA0
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00ECCC390_2_00ECCC39
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00EE6DD90_2_00EE6DD9
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00EB91C00_2_00EB91C0
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00ECB1190_2_00ECB119
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00ED13940_2_00ED1394
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00ED17060_2_00ED1706
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00ED781B0_2_00ED781B
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00ED19B00_2_00ED19B0
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00EC997D0_2_00EC997D
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00EB79200_2_00EB7920
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00ED7A4A0_2_00ED7A4A
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00ED7CA70_2_00ED7CA7
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00ED1C770_2_00ED1C77
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00EE9EEE0_2_00EE9EEE
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F3BE440_2_00F3BE44
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00ED1F320_2_00ED1F32
    Source: C:\Users\user\Desktop\file.exeCode function: String function: 00ED0A30 appears 46 times
    Source: C:\Users\user\Desktop\file.exeCode function: String function: 00ECF9F2 appears 31 times
    Source: file.exeStatic PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
    Source: classification engineClassification label: mal64.troj.evad.winEXE@51/30@12/7
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F237B5 GetLastError,FormatMessageW,0_2_00F237B5
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F110BF AdjustTokenPrivileges,CloseHandle,0_2_00F110BF
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F116C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,0_2_00F116C3
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F251CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,0_2_00F251CD
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F3A67C CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,0_2_00F3A67C
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F2648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,0_2_00F2648E
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00EB42A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,0_2_00EB42A2
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7416:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7288:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7480:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7352:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7544:120:WilError_03
    Source: file.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
    Source: C:\Windows\SysWOW64\taskkill.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
    Source: C:\Windows\SysWOW64\taskkill.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
    Source: C:\Windows\SysWOW64\taskkill.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
    Source: C:\Windows\SysWOW64\taskkill.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
    Source: C:\Windows\SysWOW64\taskkill.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
    Source: C:\Users\user\Desktop\file.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
    Source: unknownProcess created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
    Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
    Source: C:\Windows\SysWOW64\taskkill.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
    Source: C:\Windows\SysWOW64\taskkill.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
    Source: C:\Windows\SysWOW64\taskkill.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
    Source: C:\Windows\SysWOW64\taskkill.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
    Source: C:\Windows\SysWOW64\taskkill.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Users\user\Desktop\file.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2016 --field-trial-handle=1936,i,4378290034050703555,17962560962937059959,262144 /prefetch:8
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5500 --field-trial-handle=1936,i,4378290034050703555,17962560962937059959,262144 /prefetch:8
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 --field-trial-handle=1936,i,4378290034050703555,17962560962937059959,262144 /prefetch:8
    Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /TJump to behavior
    Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /TJump to behavior
    Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /TJump to behavior
    Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /TJump to behavior
    Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /TJump to behavior
    Source: C:\Users\user\Desktop\file.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobarsJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2016 --field-trial-handle=1936,i,4378290034050703555,17962560962937059959,262144 /prefetch:8Jump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5500 --field-trial-handle=1936,i,4378290034050703555,17962560962937059959,262144 /prefetch:8Jump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 --field-trial-handle=1936,i,4378290034050703555,17962560962937059959,262144 /prefetch:8Jump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Users\user\Desktop\file.exeSection loaded: wsock32.dllJump to behavior
    Source: C:\Users\user\Desktop\file.exeSection loaded: version.dllJump to behavior
    Source: C:\Users\user\Desktop\file.exeSection loaded: winmm.dllJump to behavior
    Source: C:\Users\user\Desktop\file.exeSection loaded: mpr.dllJump to behavior
    Source: C:\Users\user\Desktop\file.exeSection loaded: wininet.dllJump to behavior
    Source: C:\Users\user\Desktop\file.exeSection loaded: iphlpapi.dllJump to behavior
    Source: C:\Users\user\Desktop\file.exeSection loaded: userenv.dllJump to behavior
    Source: C:\Users\user\Desktop\file.exeSection loaded: uxtheme.dllJump to behavior
    Source: C:\Users\user\Desktop\file.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Users\user\Desktop\file.exeSection loaded: windows.storage.dllJump to behavior
    Source: C:\Users\user\Desktop\file.exeSection loaded: wldp.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: version.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: mpr.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: framedynos.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: dbghelp.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: sspicli.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: srvcli.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: netutils.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: sspicli.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: wbemcomn.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: winsta.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: amsi.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: userenv.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: profapi.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: version.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: mpr.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: framedynos.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: dbghelp.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: sspicli.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: srvcli.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: netutils.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: sspicli.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: wbemcomn.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: winsta.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: amsi.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: userenv.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: profapi.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: version.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: mpr.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: framedynos.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: dbghelp.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: sspicli.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: srvcli.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: netutils.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: sspicli.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: wbemcomn.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: winsta.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: amsi.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: userenv.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: profapi.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: version.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: mpr.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: framedynos.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: dbghelp.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: sspicli.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: srvcli.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: netutils.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: sspicli.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: wbemcomn.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: winsta.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: amsi.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: userenv.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: profapi.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: version.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: mpr.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: framedynos.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: dbghelp.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: sspicli.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: srvcli.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: netutils.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: sspicli.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: wbemcomn.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: winsta.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: amsi.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: userenv.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: profapi.dllJump to behavior
    Source: Window RecorderWindow detected: More than 3 window changes detected
    Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
    Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
    Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
    Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
    Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
    Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
    Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
    Source: file.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
    Source: file.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
    Source: file.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
    Source: file.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
    Source: file.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00EB42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_00EB42DE
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00ED0A76 push ecx; ret 0_2_00ED0A89
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00ECF98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_00ECF98E
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F41C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,0_2_00F41C41
    Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

    Malware Analysis System Evasion

    barindex
    Found API chain indicative of sandbox detection
    Source: C:\Users\user\Desktop\file.exeSandbox detection routine: GetForegroundWindow, DecisionNode, Sleepgraph_0-95824
    Source: C:\Users\user\Desktop\file.exeWindow / User API: threadDelayed 7158Jump to behavior
    Source: C:\Users\user\Desktop\file.exeWindow / User API: foregroundWindowGot 1774Jump to behavior
    Source: C:\Users\user\Desktop\file.exeAPI coverage: 3.7 %
    Source: C:\Users\user\Desktop\file.exe TID: 7268Thread sleep time: -71580s >= -30000sJump to behavior
    Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
    Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
    Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
    Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
    Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
    Source: C:\Users\user\Desktop\file.exeThread sleep count: Count: 7158 delay: -10Jump to behavior
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F1DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,0_2_00F1DBBE
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F268EE FindFirstFileW,FindClose,0_2_00F268EE
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F2698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,0_2_00F2698F
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F1D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_00F1D076
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F1D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_00F1D3A9
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F29642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00F29642
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F2979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00F2979D
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F29B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,0_2_00F29B2B
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F25C97 FindFirstFileW,FindNextFileW,FindClose,0_2_00F25C97
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00EB42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_00EB42DE
    Source: C:\Users\user\Desktop\file.exeProcess information queried: ProcessInformationJump to behavior
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F2EAA2 BlockInput,0_2_00F2EAA2
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00EE2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00EE2622
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00EB42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_00EB42DE
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00ED4CE8 mov eax, dword ptr fs:[00000030h]0_2_00ED4CE8
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F10B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,0_2_00F10B62
    Source: C:\Windows\SysWOW64\taskkill.exeProcess token adjusted: DebugJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeProcess token adjusted: DebugJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeProcess token adjusted: DebugJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeProcess token adjusted: DebugJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeProcess token adjusted: DebugJump to behavior
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00EE2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00EE2622
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00ED083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00ED083F
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00ED09D5 SetUnhandledExceptionFilter,0_2_00ED09D5
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00ED0C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00ED0C21
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F11201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,0_2_00F11201
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00EF2BA5 KiUserCallbackDispatcher,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,0_2_00EF2BA5
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F1B226 SendInput,keybd_event,0_2_00F1B226
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F322DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,0_2_00F322DA
    Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /TJump to behavior
    Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /TJump to behavior
    Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /TJump to behavior
    Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /TJump to behavior
    Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /TJump to behavior
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F10B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,0_2_00F10B62
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F11663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,0_2_00F11663
    Source: file.exeBinary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
    Source: file.exeBinary or memory string: Shell_TrayWnd
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00ED0698 cpuid 0_2_00ED0698
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F28195 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,0_2_00F28195
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F0D27A GetUserNameW,0_2_00F0D27A
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00EEBB6F _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,0_2_00EEBB6F
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00EB42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_00EB42DE

    Stealing of Sensitive Information

    barindex
    Yara detected Credential Flusher
    Source: Yara matchFile source: Process Memory Space: file.exe PID: 7264, type: MEMORYSTR
    Source: file.exeBinary or memory string: WIN_81
    Source: file.exeBinary or memory string: WIN_XP
    Source: file.exeBinary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
    Source: file.exeBinary or memory string: WIN_XPe
    Source: file.exeBinary or memory string: WIN_VISTA
    Source: file.exeBinary or memory string: WIN_7
    Source: file.exeBinary or memory string: WIN_8

    Remote Access Functionality

    barindex
    Yara detected Credential Flusher
    Source: Yara matchFile source: Process Memory Space: file.exe PID: 7264, type: MEMORYSTR
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F31204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,0_2_00F31204
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F31806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,0_2_00F31806

    Mitre Att&ck Matrix

    ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
    Gather Victim Identity InformationAcquire Infrastructure2
    Valid Accounts    		1
    Windows Management Instrumentation    		1
    DLL Side-Loading    		1
    Exploitation for Privilege Escalation    		2
    Disable or Modify Tools    		21
    Input Capture    		2
    System Time Discovery    		Remote Services1
    Archive Collected Data    		2
    Ingress Tool Transfer    		Exfiltration Over Other Network Medium1
    System Shutdown/Reboot
    CredentialsDomainsDefault Accounts1
    Native API    		2
    Valid Accounts    		1
    DLL Side-Loading    		1
    Deobfuscate/Decode Files or Information    		LSASS Memory1
    Account Discovery    		Remote Desktop Protocol21
    Input Capture    		11
    Encrypted Channel    		Exfiltration Over BluetoothNetwork Denial of Service
    Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)2
    Valid Accounts    		2
    Obfuscated Files or Information    		Security Account Manager1
    File and Directory Discovery    		SMB/Windows Admin Shares3
    Clipboard Data    		3
    Non-Application Layer Protocol    		Automated ExfiltrationData Encrypted for Impact
    Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook21
    Access Token Manipulation    		1
    DLL Side-Loading    		NTDS16
    System Information Discovery    		Distributed Component Object ModelInput Capture4
    Application Layer Protocol    		Traffic DuplicationData Destruction
    Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script2
    Process Injection    		2
    Valid Accounts    		LSA Secrets12
    Security Software Discovery    		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
    Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts12
    Virtualization/Sandbox Evasion    		Cached Domain Credentials12
    Virtualization/Sandbox Evasion    		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
    DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items21
    Access Token Manipulation    		DCSync3
    Process Discovery    		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
    Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job2
    Process Injection    		Proc Filesystem11
    Application Window Discovery    		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
    Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAtHTML Smuggling/etc/passwd and /etc/shadow1
    System Owner/User Discovery    		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

    Behavior Graph

    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Is Windows Process
    • Number of created Registry Values
    • Number of created Files
    • Visual Basic
    • Delphi
    • Java
    • .Net C# or VB.NET
    • C, C++ or other language
    • Is malicious
    • Internet
    behaviorgraph top1 signatures2 2 Behavior Graph ID: 1527956 Sample: file.exe Startdate: 07/10/2024 Architecture: WINDOWS Score: 64 46 Yara detected Credential Flusher 2->46 48 Binary is likely a compiled AutoIt script file 2->48 50 Machine Learning detection for sample 2->50 52 AI detected suspicious sample 2->52 7 file.exe 2->7         started        process3 signatures4 54 Binary is likely a compiled AutoIt script file 7->54 56 Found API chain indicative of sandbox detection 7->56 10 chrome.exe 1 7->10         started        13 taskkill.exe 1 7->13         started        15 taskkill.exe 1 7->15         started        17 3 other processes 7->17 process5 dnsIp6 42 192.168.2.4, 138, 443, 49188 unknown unknown 10->42 44 239.255.255.250 unknown Reserved 10->44 19 chrome.exe 10->19         started        22 chrome.exe 10->22         started        24 chrome.exe 6 10->24         started        26 conhost.exe 13->26         started        28 conhost.exe 15->28         started        30 conhost.exe 17->30         started        32 conhost.exe 17->32         started        34 conhost.exe 17->34         started        process7 dnsIp8 36 www.google.com 142.250.185.68, 443, 49741, 49861 GOOGLEUS United States 19->36 38 142.250.186.110, 443, 49913, 49929 GOOGLEUS United States 19->38 40 6 other IPs or domains 19->40

    Screenshots

    Thumbnails

    This section contains all screenshots as thumbnails, including those not shown in the slideshow.


    windows-stand

    Antivirus, Machine Learning and Genetic Malware Detection

    Initial Sample

    SourceDetectionScannerLabelLink
    file.exe100%Joe Sandbox ML

    Dropped Files

    ⊘No Antivirus matches

    Unpacked PE Files

    ⊘No Antivirus matches

    Domains

    ⊘No Antivirus matches

    URLs

    SourceDetectionScannerLabelLink
    https://play.google/intl/0%URL Reputationsafe
    https://families.google.com/intl/0%URL Reputationsafe
    https://policies.google.com/technologies/location-data0%URL Reputationsafe
    https://apis.google.com/js/api.js0%URL Reputationsafe
    https://policies.google.com/privacy/google-partners0%URL Reputationsafe
    https://policies.google.com/terms/service-specific0%URL Reputationsafe
    https://g.co/recover0%URL Reputationsafe
    https://policies.google.com/privacy/additional0%URL Reputationsafe
    https://support.google.com/websearch/answer/4358949?hl=ko&ref_topic=32850720%URL Reputationsafe
    https://policies.google.com/technologies/cookies0%URL Reputationsafe
    https://policies.google.com/terms0%URL Reputationsafe
    https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=0%URL Reputationsafe
    https://support.google.com/accounts?hl=0%URL Reputationsafe
    https://policies.google.com/terms/location0%URL Reputationsafe
    https://policies.google.com/privacy0%URL Reputationsafe
    https://support.google.com/accounts?p=new-si-ui0%URL Reputationsafe
    https://apis.google.com/js/rpc:shindig_random.js?onload=credentialservice.postMessage0%URL Reputationsafe

    Domains and IPs

    Contacted Domains

    NameIPActiveMaliciousAntivirus DetectionReputation
    youtube-ui.l.google.com
    		172.217.18.110
    		truefalse
      		unknown
      www3.l.google.com
      		216.58.206.46
      		truefalse
        		unknown
        play.google.com
        		142.250.181.238
        		truefalse
          		unknown
          www.google.com
          		142.250.185.68
          		truefalse
            		unknown
            youtube.com
            		172.217.16.142
            		truefalse
              		unknown
              accounts.youtube.com
              		unknown
              		unknownfalse
                		unknown
                www.youtube.com
                		unknown
                		unknownfalse
                  		unknown

                  Contacted URLs

                  NameMaliciousAntivirus DetectionReputation
                  https://play.google.com/log?format=json&hasfast=true&authuser=0false
                    		unknown
                    https://www.google.com/favicon.icofalse
                      		unknown

                      URLs from Memory and Binaries

                      NameSourceMaliciousAntivirus DetectionReputation
                      https://play.google/intl/chromecache_149.13.drfalse
                      • URL Reputation: safe
                      		unknown
                      https://families.google.com/intl/chromecache_149.13.drfalse
                      • URL Reputation: safe
                      		unknown
                      https://youtube.com/t/terms?gl=chromecache_149.13.drfalse
                        		unknown
                        https://policies.google.com/technologies/location-datachromecache_149.13.drfalse
                        • URL Reputation: safe
                        		unknown
                        https://www.google.com/intl/chromecache_149.13.drfalse
                          		unknown
                          https://apis.google.com/js/api.jschromecache_145.13.drfalse
                          • URL Reputation: safe
                          		unknown
                          https://policies.google.com/privacy/google-partnerschromecache_149.13.drfalse
                          • URL Reputation: safe
                          		unknown
                          https://play.google.com/work/enroll?identifier=chromecache_149.13.drfalse
                            		unknown
                            https://policies.google.com/terms/service-specificchromecache_149.13.drfalse
                            • URL Reputation: safe
                            		unknown
                            https://g.co/recoverchromecache_149.13.drfalse
                            • URL Reputation: safe
                            		unknown
                            https://policies.google.com/privacy/additionalchromecache_149.13.drfalse
                            • URL Reputation: safe
                            		unknown
                            https://support.google.com/websearch/answer/4358949?hl=ko&ref_topic=3285072chromecache_149.13.drfalse
                            • URL Reputation: safe
                            		unknown
                            https://policies.google.com/technologies/cookieschromecache_149.13.drfalse
                            • URL Reputation: safe
                            		unknown
                            https://policies.google.com/termschromecache_149.13.drfalse
                            • URL Reputation: safe
                            		unknown
                            https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=chromecache_145.13.drfalse
                            • URL Reputation: safe
                            		unknown
                            https://www.google.comchromecache_149.13.drfalse
                              		unknown
                              https://play.google.com/log?format=json&hasfast=truechromecache_149.13.drfalse
                                		unknown
                                https://www.youtube.com/t/terms?chromeless=1&hl=chromecache_149.13.drfalse
                                  		unknown
                                  https://support.google.com/accounts?hl=chromecache_149.13.drfalse
                                  • URL Reputation: safe
                                  		unknown
                                  https://policies.google.com/terms/locationchromecache_149.13.drfalse
                                  • URL Reputation: safe
                                  		unknown
                                  https://policies.google.com/privacychromecache_149.13.drfalse
                                  • URL Reputation: safe
                                  		unknown
                                  https://support.google.com/accounts?p=new-si-uichromecache_149.13.drfalse
                                  • URL Reputation: safe
                                  		unknown
                                  https://apis.google.com/js/rpc:shindig_random.js?onload=credentialservice.postMessagechromecache_149.13.drfalse
                                  • URL Reputation: safe
                                  		unknown

                                  World Map of Contacted IPs

                                  • No. of IPs < 25%
                                  • 25% < No. of IPs < 50%
                                  • 50% < No. of IPs < 75%
                                  • 75% < No. of IPs

                                  Public IPs

                                  IPDomainCountryFlagASNASN NameMalicious
                                  142.250.185.68
                                  		www.google.comUnited States
                                  		15169GOOGLEUSfalse
                                  216.58.206.46
                                  		www3.l.google.comUnited States
                                  		15169GOOGLEUSfalse
                                  239.255.255.250
                                  		unknownReserved
                                  		unknownunknownfalse
                                  142.250.186.110
                                  		unknownUnited States
                                  		15169GOOGLEUSfalse
                                  172.217.18.110
                                  		youtube-ui.l.google.comUnited States
                                  		15169GOOGLEUSfalse
                                  172.217.16.142
                                  		youtube.comUnited States
                                  		15169GOOGLEUSfalse

                                  Private

                                  IP
                                  192.168.2.4

                                  General Information

                                  Joe Sandbox version:41.0.0 Charoite
                                  Analysis ID:1527956
                                  Start date and time:2024-10-07 13:22:05 +02:00
                                  Joe Sandbox product:CloudBasic
                                  Overall analysis duration:0h 5m 1s
                                  Hypervisor based Inspection enabled:false
                                  Report type:full
                                  Cookbook file name:default.jbs
                                  Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                  Number of analysed new started processes analysed:20
                                  Number of new started drivers analysed:0
                                  Number of existing processes analysed:0
                                  Number of existing drivers analysed:0
                                  Number of injected processes analysed:0
                                  Technologies:
                                  • HCA enabled
                                  • EGA enabled
                                  • AMSI enabled
                                  Analysis Mode:default
                                  Analysis stop reason:Timeout
                                  Sample name:file.exe
                                  Detection:MAL
                                  Classification:mal64.troj.evad.winEXE@51/30@12/7
                                  EGA Information:
                                  • Successful, ratio: 100%
                                  HCA Information:
                                  • Successful, ratio: 95%
                                  • Number of executed functions: 41
                                  • Number of non-executed functions: 311
                                  Cookbook Comments:
                                  • Found application associated with file extension: .exe

                                  Warnings

                                  • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
                                  • Excluded IPs from analysis (whitelisted): 142.250.74.195, 142.250.181.238, 142.251.168.84, 34.104.35.123, 142.250.185.227, 172.217.16.131, 142.250.185.74, 142.250.185.170, 142.250.186.42, 142.250.185.106, 142.250.186.74, 142.250.184.234, 142.250.185.202, 216.58.212.170, 142.250.181.234, 142.250.186.170, 216.58.212.138, 142.250.185.234, 142.250.186.106, 142.250.186.138, 216.58.206.42, 172.217.16.202, 142.250.185.138, 172.217.18.10, 172.217.18.106, 142.250.184.202, 216.58.206.74, 93.184.221.240, 192.229.221.95, 142.250.186.163, 66.102.1.84, 216.58.212.142
                                  • Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, otelrules.azureedge.net, fonts.gstatic.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, update.googleapis.com, clients.l.google.com, www.gstatic.com, optimizationguide-pa.googleapis.com
                                  • HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
                                  • Not all processes where analyzed, report is missing behavior information
                                  • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                  • VT rate limit hit for: file.exe

                                  Simulations

                                  Behavior and APIs

                                  ⊘No simulations

                                  Joe Sandbox View / Context

                                  IPs

                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                  239.255.255.250https://emmaway-my.sharepoint.com/:f:/g/personal/jessica_emmaway_uk/Eodal0AmsKFKtMeEeNJG0V0B3d0_hcKMrsOYen-8p5FxhQ?e=bBSdNWGet hashmaliciousUnknownBrowse
                                    http://www.twbcompany.comGet hashmaliciousUnknownBrowse
                                      https://cloud.list.lu/index.php/s/znw4dNSttiDzHTBGet hashmaliciousUnknownBrowse
                                        c3KH2gLNrM.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, Stealc, VidarBrowse
                                          http://46.27.141.62Get hashmaliciousUnknownBrowse
                                            https://kohlhage-de.powerappsportals.com/Get hashmaliciousHtmlDropper, HTMLPhisherBrowse
                                              High Court Summons Notice.pdfGet hashmaliciousUnknownBrowse
                                                https://kohlhage-de.powerappsportals.com/Get hashmaliciousHtmlDropperBrowse
                                                  file.exeGet hashmaliciousCredential FlusherBrowse
                                                    cfev.-Information refb08b4d10f3ce74a317adeabab8ac66ad.htmGet hashmaliciousUnknownBrowse

                                                      Domains

                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                      play.google.comc3KH2gLNrM.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, Stealc, VidarBrowse
                                                      • 172.217.18.110
                                                      file.exeGet hashmaliciousCredential FlusherBrowse
                                                      • 216.58.206.46
                                                      file.exeGet hashmaliciousCredential FlusherBrowse
                                                      • 142.250.185.142
                                                      Fact-2024-10.pdfGet hashmaliciousUnknownBrowse
                                                      • 142.250.185.142
                                                      4qZ59IMp8b.exeGet hashmaliciousCredential FlusherBrowse
                                                      • 142.250.185.174
                                                      http://appeal-voilation-policy-issues.github.io/Submit-review-/Get hashmaliciousUnknownBrowse
                                                      • 142.250.185.142
                                                      file.exeGet hashmaliciousCredential FlusherBrowse
                                                      • 142.250.186.110
                                                      http://sites.google.com/coinswallett.com/walletconnectt/home/Get hashmaliciousUnknownBrowse
                                                      • 142.250.74.206
                                                      https://allegrolokalnie.p24-v990d8a01.pl/oferta/df10e59f-ef1b-4d67-8f86-5b7cf2069508Get hashmaliciousUnknownBrowse
                                                      • 172.217.18.14
                                                      file.exeGet hashmaliciousCredential FlusherBrowse
                                                      • 142.250.184.206

                                                      ASNs

                                                      ⊘No context

                                                      JA3 Fingerprints

                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                      28a2c9bd18a11de089ef85a160da29e4https://emmaway-my.sharepoint.com/:f:/g/personal/jessica_emmaway_uk/Eodal0AmsKFKtMeEeNJG0V0B3d0_hcKMrsOYen-8p5FxhQ?e=bBSdNWGet hashmaliciousUnknownBrowse
                                                      • 4.175.87.197
                                                      • 184.28.90.27
                                                      • 13.107.246.45
                                                      http://www.twbcompany.comGet hashmaliciousUnknownBrowse
                                                      • 4.175.87.197
                                                      • 184.28.90.27
                                                      • 13.107.246.45
                                                      https://cloud.list.lu/index.php/s/znw4dNSttiDzHTBGet hashmaliciousUnknownBrowse
                                                      • 4.175.87.197
                                                      • 184.28.90.27
                                                      • 13.107.246.45
                                                      c3KH2gLNrM.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, Stealc, VidarBrowse
                                                      • 4.175.87.197
                                                      • 184.28.90.27
                                                      • 13.107.246.45
                                                      http://46.27.141.62Get hashmaliciousUnknownBrowse
                                                      • 4.175.87.197
                                                      • 184.28.90.27
                                                      • 13.107.246.45
                                                      https://kohlhage-de.powerappsportals.com/Get hashmaliciousHtmlDropper, HTMLPhisherBrowse
                                                      • 4.175.87.197
                                                      • 184.28.90.27
                                                      • 13.107.246.45
                                                      High Court Summons Notice.pdfGet hashmaliciousUnknownBrowse
                                                      • 4.175.87.197
                                                      • 184.28.90.27
                                                      • 13.107.246.45
                                                      file.exeGet hashmaliciousCredential FlusherBrowse
                                                      • 4.175.87.197
                                                      • 184.28.90.27
                                                      • 13.107.246.45
                                                      SecuriteInfo.com.Win32.PWSX-gen.19312.293.exeGet hashmaliciousUnknownBrowse
                                                      • 4.175.87.197
                                                      • 184.28.90.27
                                                      • 13.107.246.45
                                                      file.exeGet hashmaliciousCredential FlusherBrowse
                                                      • 4.175.87.197
                                                      • 184.28.90.27
                                                      • 13.107.246.45

                                                      Dropped Files

                                                      ⊘No context

                                                      Created / dropped Files

                                                      Chrome Cache Entry: 141

                                                      Download File
                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      File Type:ASCII text, with very long lines (533)
                                                      Category:downloaded
                                                      Size (bytes):9211
                                                      Entropy (8bit):5.393454943843583
                                                      Encrypted:false
                                                      SSDEEP:192:t7mFYxV97IeIa0U44rS3mt8IV7ydti6M5/1JlNg:t7vB7Ir2t+dEF1JlNg
                                                      MD5:1848ADF9DF4F0B9EB4E56FFA23A16796
                                                      SHA1:CC54EFA712F6F82DE0977905A5FFF1D1029B5BDF
                                                      SHA-256:5A43C2FDD10E0D10637D203FAEA519F034A13303F0ED542408C558D727C1AA56
                                                      SHA-512:AB63E6B3394B274C0546BBFF4444816CF79A4D892DE9BB7FBC7EEAFBE37A396F22278D5EDBA81DD19D28B9614AB0D83243E12B1F4322FE95E13FD7271CE05255
                                                      Malicious:false
                                                      URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.PqO-Y4U4tl0.es5.O/ck=boq-identity.AccountsSignInUi.nq70RHujW6U.L.B1.O/am=xMFgKBm2EQjEH54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=AvtSve,CMcBD,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PrPYRd,Rkm0ef,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,byfTOb,cYShmd,eVCnO,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,qPfo0c,qmdT9,rCcCxc,siKnQd,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHcm_AmnkxyZDRYujxIEpRVVQs8wA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ltDFwf,SD8Jgb,rmumx,E87wgc,qPYxq,Tbb4sb,pxq3x,f8Gu1e,soHxf,YgOFye,yRXbo,bTi8wc,ywOR5c,PHUIyb"
                                                      Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.vNa=_.z("SD8Jgb",[]);._.GX=function(a,b){if(typeof b==="string")a.Nc(b);else if(b instanceof _.Ip&&b.ia&&b.ia===_.A)b=_.Za(b.Ku()),a.empty().append(b);else if(b instanceof _.Ua)b=_.Za(b),a.empty().append(b);else if(b instanceof Node)a.empty().append(b);else throw Error("Wf");};_.HX=function(a){var b=_.Lo(a,"[jsslot]");if(b.size()>0)return b;b=new _.Jo([_.Qk("span")]);_.Mo(b,"jsslot","");a.empty().append(b);return b};_.bMb=function(a){return a===null||typeof a==="string"&&_.Ji(a)};._.k("SD8Jgb");._.MX=function(a){_.X.call(this,a.Fa);this.Va=a.controller.Va;this.od=a.controllers.od[0]||null;this.header=a.controller.header;this.nav=a.controller.nav;var b;(b=this.oa().find("button:not([type])").el())==null||b.setAttribute("type","button")};_.J(_.MX,_.X);_.MX.Ba=function(){return{controller:{Va:{jsname:"n7vHCb",ctor:_.pv},header:{jsname:"tJHJj",ctor:_.pv},nav:{jsname:"DH6Rkf",ct

                                                      Chrome Cache Entry: 142

                                                      Download File
                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      File Type:HTML document, ASCII text, with very long lines (681)
                                                      Category:downloaded
                                                      Size (bytes):4068
                                                      Entropy (8bit):5.370430682968771
                                                      Encrypted:false
                                                      SSDEEP:96:G6mTOIiY1medWRQrf7VF6vtDgXJyA7oxcoTsw:3mTOImedWOVF6vtUJyA8xJZ
                                                      MD5:AF3C2B50FABC8DDB5CDAEFFEA7878CB9
                                                      SHA1:2D75D985CCE4453480787700B96B81809BB0DAEC
                                                      SHA-256:3468FD73B47F212173B6C8B32DB6DD9F3348617BA4BFDC77A1939B1BB98A2438
                                                      SHA-512:8CCD6C833BEAF40E0CD35F48E8BCE38CD8315B38C4A1EAFFE958A79D37A145FB16BB217A503C37F29A09949E837A4A5BBB1C96B1F4E8D1A66D3FCEB188EE17B9
                                                      Malicious:false
                                                      URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.PqO-Y4U4tl0.es5.O/ck=boq-identity.AccountsSignInUi.nq70RHujW6U.L.B1.O/am=xMFgKBm2EQjEH54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHcm_AmnkxyZDRYujxIEpRVVQs8wA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=sOXFj,q0xTif,ZZ4WUe"
                                                      Preview:"use strict";_F_installCss(".N7rBcd{overflow-x:auto}sentinel{}");.this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.vg(_.bqa);._.k("sOXFj");.var wu=function(a){_.W.call(this,a.Fa)};_.J(wu,_.W);wu.Ba=_.W.Ba;wu.prototype.aa=function(a){return a()};_.qu(_.aqa,wu);._.l();._.k("oGtAuc");._.Bya=new _.pf(_.bqa);._.l();._.k("q0xTif");.var vza=function(a){var b=function(d){_.Zn(d)&&(_.Zn(d).Lc=null,_.Gu(d,null));d.XyHi9&&(d.XyHi9=null)};b(a);a=a.querySelectorAll("[c-wiz]");for(var c=0;c<a.length;c++)b(a[c])},Su=function(a){_.nt.call(this,a.Fa);this.Qa=this.dom=null;if(this.rl()){var b=_.Cm(this.Wg(),[_.Hm,_.Gm]);b=_.pi([b[_.Hm],b[_.Gm]]).then(function(c){this.Qa=c[0];this.dom=c[1]},null,this);_.ku(this,b)}this.Ra=a.lm.Dea};_.J(Su,_.nt);Su.Ba=function(){return{lm:{Dea:function(a){return _.Ue(a)}}}};Su.prototype.Bp=function(a){return this.Ra.Bp(a)};.Su.prototype.getData=function(a){return this.Ra.getData(a)};Su.prototype.uo=function(){_.Nt(this.d

                                                      Chrome Cache Entry: 143

                                                      Download File
                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                      Category:downloaded
                                                      Size (bytes):5430
                                                      Entropy (8bit):3.6534652184263736
                                                      Encrypted:false
                                                      SSDEEP:48:wIJct3xIAxG/7nvWDtZcdYLtX7B6QXL3aqG8Q:wIJct+A47v+rcqlBPG9B
                                                      MD5:F3418A443E7D841097C714D69EC4BCB8
                                                      SHA1:49263695F6B0CDD72F45CF1B775E660FDC36C606
                                                      SHA-256:6DA5620880159634213E197FAFCA1DDE0272153BE3E4590818533FAB8D040770
                                                      SHA-512:82D017C4B7EC8E0C46E8B75DA0CA6A52FD8BCE7FCF4E556CBDF16B49FC81BE9953FE7E25A05F63ECD41C7272E8BB0A9FD9AEDF0AC06CB6032330B096B3702563
                                                      Malicious:false
                                                      URL:https://www.google.com/favicon.ico
                                                      Preview:............ .h...&... .... .........(....... ..... ............................................0...................................................................................................................................v.].X.:.X.:.r.Y........................................q.X.S.4.S.4.S.4.S.4.S.4.S.4...X....................0........q.W.S.4.X.:.................J...A...g.........................K.H.V.8..........................F..B.....................,.......................................B..............................................B..B..B..B..B...u..........................................B..B..B..B..B...{.................5.......k...........................................................7R..8F.................................................2........Vb..5C..;I..................R^.....................0................Xc..5C..5C..5C..5C..5C..5C..lv..........................................]i..<J..:G..Zf....................................................

                                                      Chrome Cache Entry: 144

                                                      Download File
                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      File Type:ASCII text, with very long lines (468)
                                                      Category:downloaded
                                                      Size (bytes):1858
                                                      Entropy (8bit):5.297658905867848
                                                      Encrypted:false
                                                      SSDEEP:48:o7vjoGL3AeFkphnpiu7cOyBfO/3d/rYrv3Zrw:ofrLxFuLdyp2AVw
                                                      MD5:B42DB3D22B12B8E3BE1B82961FE2870E
                                                      SHA1:D9CFD11C1C2DE17A7E9301F11AD875B610B96576
                                                      SHA-256:75DC40A81CEACB57940F84D2B29E021974C3004B245CC7198362CA944E9C4058
                                                      SHA-512:EC0708797586F8F85EC8A0BBECA707D73778D93C12986B92965D1828B254D39485926354AEC4D73474BC5755E392B813D8045B19369FAE23B30BBD12E17F7053
                                                      Malicious:false
                                                      URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.PqO-Y4U4tl0.es5.O/ck=boq-identity.AccountsSignInUi.nq70RHujW6U.L.B1.O/am=xMFgKBm2EQjEH54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHcm_AmnkxyZDRYujxIEpRVVQs8wA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=iAskyc,ziXSP"
                                                      Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.k("iAskyc");._.QZ=function(a){_.W.call(this,a.Fa);this.window=a.Ea.window.get();this.Mc=a.Ea.Mc};_.J(_.QZ,_.W);_.QZ.Ba=function(){return{Ea:{window:_.tu,Mc:_.HE}}};_.QZ.prototype.Po=function(){};_.QZ.prototype.addEncryptionRecoveryMethod=function(){};_.RZ=function(a){return(a==null?void 0:a.Jo)||function(){}};_.SZ=function(a){return(a==null?void 0:a.r3)||function(){}};_.VPb=function(a){return(a==null?void 0:a.Qp)||function(){}};._.WPb=function(a){return new Map(Array.from(a,function(b){var c=_.n(b);b=c.next().value;c=c.next().value;return[b,c.map(function(d){return{epoch:d.epoch,key:new Uint8Array(d.key)}})]}))};_.XPb=function(a){setTimeout(function(){throw a;},0)};_.QZ.prototype.qO=function(){return!0};_.qu(_.Dn,_.QZ);._.l();._.k("ziXSP");.var j_=function(a){_.QZ.call(this,a.Fa)};_.J(j_,_.QZ);j_.Ba=_.QZ.Ba;j_.prototype.Po=function(a,b,c){var d;if((d=this.window.chrome)==nu

                                                      Chrome Cache Entry: 145

                                                      Download File
                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      File Type:ASCII text, with very long lines (553)
                                                      Category:downloaded
                                                      Size (bytes):744742
                                                      Entropy (8bit):5.792855158264205
                                                      Encrypted:false
                                                      SSDEEP:6144:l5bdWK/20rOQKKQtvqUGSGDdPSxdZqmguPH:9OeKGSpgu/
                                                      MD5:1C074FFA394C0A391A155AA7BC324B94
                                                      SHA1:4AE0B6B55F93194332B80C7FF405C530A5093626
                                                      SHA-256:6E86F756E8C9EF4090EA0E9F026224F63FD45BB96C39FBC5BBC9862A6C65DC35
                                                      SHA-512:6CFA6277ABD8C140A00BDB15EBA93656E3F2A2E3A20D850003655BC63B7E3229354CD71F07B335D27B43600DD906C61738D151854D5076D8AC34BB0C2A6D6C32
                                                      Malicious:false
                                                      URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.PqO-Y4U4tl0.es5.O/am=xMFgKBm2EQjEH54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlH3q0jVbYYiO617zFp27kMqU3AaWg/m=_b,_tp"
                                                      Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a||[]};(0,_._F_toggles_initialize)([0x2860c1c4, 0x2046d864, 0x39e1fc40, 0x14501e80, 0xe420, 0x0, 0x1a000000, 0x1d000003, 0xc, ]);./*.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0.*/./*.. Copyright Google LLC. SPDX-License-Identifier: Apache-2.0.*/./*.. Copyright 2024 Google, Inc. SPDX-License-Identifier: MIT.*/./*. SPDX-License-Identifier: Apache-2.0.*/./*. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0.*/.var baa,daa,Na,Ta,gaa,iaa,jb,qaa,waa,Caa,Haa,Kaa,Jb,Laa,Ob,Qb,Rb,Maa,Naa,Sb,Oaa,Paa,Qaa,Yb,Vaa,Xaa,ec,fc,gc,bba,cba,gba,jba,lba,mba,qba,tba,nba,sba,rba,pba,oba,uba,yba,Cba,Dba,Aba,Hc,Ic,Gba,Iba,Mba,Nba,Oba,Pba,Lba,Qba,Sba,dd,Uba,Vba,Xba,Zba,Yba,aca,bca,cca,dca,fca,eca,hca,ica,jca,kca,nca,

                                                      Chrome Cache Entry: 146

                                                      Download File
                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      File Type:Web Open Font Format (Version 2), TrueType, length 52280, version 1.0
                                                      Category:downloaded
                                                      Size (bytes):52280
                                                      Entropy (8bit):7.995413196679271
                                                      Encrypted:true
                                                      SSDEEP:1536:1rvqtK8DZilXxwJ8mMwAZy7phqsFLdG3B4d:xytBZits8bw4wzbFxG3B4d
                                                      MD5:F61F0D4D0F968D5BBA39A84C76277E1A
                                                      SHA1:AA3693EA140ECA418B4B2A30F6A68F6F43B4BEB2
                                                      SHA-256:57147F08949ABABE7DEEF611435AE418475A693E3823769A25C2A39B6EAD9CCC
                                                      SHA-512:6C3BD90F709BCF9151C9ED9FFEA55C4F6883E7FDA2A4E26BF018C83FE1CFBE4F4AA0DB080D6D024070D53B2257472C399C8AC44EEFD38B9445640EFA85D5C487
                                                      Malicious:false
                                                      URL:https://fonts.gstatic.com/s/googlesans/v58/4UaRrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iq2vgCI.woff2
                                                      Preview:wOF2.......8.....................................^...$..4?HVAR..?MVAR9.`?STAT.*',..J/.......`..(..Z.0..R.6.$.... .....K..[..q..c..T.....>.P.j.`.w..#...%......N.".....$..3.0.6......... .L.rX/r[j.y.|*(.4.%#.....2.v.m..-..%.....;-.Y.{..&..O=#l@...k..7g..ZI...#.Z./+T..r7...M..3).Z%.x....s..sL..[A!.5*1w'/.8V..2Z..%.X.h.o.).]..9..Q`.$.....7..kZ.~O........d..g.n.d.Rw+&....Cz..uy#..fz,(.J....v.%..`..9.....h...?O..:...c%.....6s....xl..#...5..._......1.>.)"U.4 W....?%......6//!$...!.n9C@n...........!""^.....W..Z<.7.x.."UT.T....E.."R>.R..t.....H d..e_.K../.+8.Q.P.ZQ....;...U....]......._.e*......71.?.7.ORv.?...l...G|.P...|:...I.X..2.,.L........d.g.]}W#uW]QnuP-s.;.-Y.....].......C..j_.M0...y.......J..........NY..@A...,....-.F......'..w./j5g.vUS...U..0.&...y7.LP.....%.....Y......Y..D. e.A..G.?.$.......6...eaK.n5.m...N...,...+BCl..L> .E9~.b[.w.x....6<...}.e...%V....O.......*.?...a..#[eE.4..p..$...].....%......o._......N.._~..El....b..A.0.r8.....|..D.d..

                                                      Chrome Cache Entry: 147

                                                      Download File
                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      File Type:ASCII text, with very long lines (522)
                                                      Category:downloaded
                                                      Size (bytes):5050
                                                      Entropy (8bit):5.30005628600801
                                                      Encrypted:false
                                                      SSDEEP:96:o75BuBxJfma7bGZABddEgf8nI4zLm4KGo8Vh1EabPVTq8fv/xRw:WHMmaX9r8Igp7nBlHo
                                                      MD5:D9F15F1AEAF15673336FAA3507D1A2A7
                                                      SHA1:FC79D00AF2E2D44FEBA701F12ECD4AFCA327F464
                                                      SHA-256:AA3574ADCF3826390918BC2D5DCD88D7BC63238A6022DEF3487A67A731C30E7A
                                                      SHA-512:D756961B6BFC478274E390B94D613BD837DA011D680FC6D67779A8E12C7F082EF977FC15D02C076F92BC1D2CE7EFDE48F82B4EC1BD12CF38AEDDAB1917E36041
                                                      Malicious:false
                                                      URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.PqO-Y4U4tl0.es5.O/ck=boq-identity.AccountsSignInUi.nq70RHujW6U.L.B1.O/am=xMFgKBm2EQjEH54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,iAskyc,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziXSP,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHcm_AmnkxyZDRYujxIEpRVVQs8wA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=wg1P6b"
                                                      Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.oNa=_.z("wg1P6b",[_.XA,_.Fn,_.Nn]);._.k("wg1P6b");.var f6a;f6a=_.mh(["aria-"]);._.yJ=function(a){_.X.call(this,a.Fa);this.Ka=this.xa=this.aa=this.viewportElement=this.Na=null;this.Jc=a.Ea.ef;this.ab=a.Ea.focus;this.Fc=a.Ea.Fc;this.ea=this.Qi();a=-1*parseInt(_.Fo(this.Qi().el(),"marginTop")||"0",10);var b=parseInt(_.Fo(this.Qi().el(),"marginBottom")||"0",10);this.Ta={top:a,right:0,bottom:b,left:0};a=_.cf(this.getData("isMenuDynamic"),!1);b=_.cf(this.getData("isMenuHoisted"),!1);this.Ga=a?1:b?2:0;this.ka=!1;this.Ca=1;this.Ga!==1&&(this.aa=this.Sa("U0exHf").children().Wc(0),_.ku(this,.g6a(this,this.aa.el())));_.oF(this.oa())&&(a=this.oa().el(),b=this.we.bind(this),a.__soy_skip_handler=b)};_.J(_.yJ,_.X);_.yJ.Ba=function(){return{Ea:{ef:_.cF,focus:_.OE,Fc:_.uu}}};_.yJ.prototype.IF=function(a){var b=a.source;this.Na=b;var c;((c=a.data)==null?0:c.qz)?(a=a.data.qz,this.Ca=a==="MOUS

                                                      Chrome Cache Entry: 148

                                                      Download File
                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      File Type:ASCII text, with very long lines (1694)
                                                      Category:downloaded
                                                      Size (bytes):32500
                                                      Entropy (8bit):5.378121087555083
                                                      Encrypted:false
                                                      SSDEEP:768:OnTTScxIXeijt4aRZf4AEqTzQh2HIVVcYTVf79pew6cVEkAXtuWsmsL:iA4w4A4h2HIVVcMVf72QA9jOL
                                                      MD5:57D7B0A2CE36496F05AFA27B39C1F219
                                                      SHA1:418AD03C2E75AEAF188E2A00123B70E09D541656
                                                      SHA-256:E247A1F5E564A248C92E39C040A06B9B3BEA50A130CC98F2787FB5E2441E0707
                                                      SHA-512:78B135A69424F951AC7E3CCBDC4F496BCA0BE6A2312DC90DFA29032C7DB19455B7E35FEE57F470729EC5E86D52DC19037BB6404C27DF614A548DE409527866C2
                                                      Malicious:false
                                                      URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.PqO-Y4U4tl0.es5.O/ck=boq-identity.AccountsSignInUi.nq70RHujW6U.L.B1.O/am=xMFgKBm2EQjEH54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=_b,_tp/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHcm_AmnkxyZDRYujxIEpRVVQs8wA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=byfTOb,lsjVmc,LEikZe"
                                                      Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{.var Cua=function(a,b){this.da=a;this.ea=b;if(!c){var c=new _.gp("//www.google.com/images/cleardot.gif");_.rp(c)}this.ka=c};_.h=Cua.prototype;_.h.Zc=null;_.h.rZ=1E4;_.h.jA=!1;_.h.sQ=0;_.h.JJ=null;_.h.gV=null;_.h.setTimeout=function(a){this.rZ=a};_.h.start=function(){if(this.jA)throw Error("dc");this.jA=!0;this.sQ=0;Dua(this)};_.h.stop=function(){Eua(this);this.jA=!1};.var Dua=function(a){a.sQ++;navigator!==null&&"onLine"in navigator&&!navigator.onLine?_.om((0,_.bg)(a.hH,a,!1),0):(a.aa=new Image,a.aa.onload=(0,_.bg)(a.Kja,a),a.aa.onerror=(0,_.bg)(a.Jja,a),a.aa.onabort=(0,_.bg)(a.Ija,a),a.JJ=_.om(a.Lja,a.rZ,a),a.aa.src=String(a.ka))};_.h=Cua.prototype;_.h.Kja=function(){this.hH(!0)};_.h.Jja=function(){this.hH(!1)};_.h.Ija=function(){this.hH(!1)};_.h.Lja=function(){this.hH(!1)};._.h.hH=function(a){Eua(this);a?(this.jA=!1,this.da.call(this.ea,!0)):this.sQ<=0?Dua(this):(this.jA=!1,

                                                      Chrome Cache Entry: 149

                                                      Download File
                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      File Type:ASCII text, with very long lines (5693)
                                                      Category:downloaded
                                                      Size (bytes):698854
                                                      Entropy (8bit):5.5949878545992435
                                                      Encrypted:false
                                                      SSDEEP:6144:TN3KfgnkxgOYoRvEoQvSXwojVlmGa/ZLJi9pZkvgTa5PB1+UO5Hx+B8U2+:TUMkxgOENagFxJiSU+
                                                      MD5:16A9D8B7D80B923760B086BCBE3F98DE
                                                      SHA1:DFCDCDCAC1E5D5148C61B0BF9ACAD1BF59011AA5
                                                      SHA-256:404818CE1670AF132D3DD0E6A6AFFD2D2B23167CBDFBBFCB62D52AD36B164380
                                                      SHA-512:11E6899995C67296B65FBEA94A2944B8C7AA49C3A11DC9A249C9D5BB4738CAD2FBF3FDECA306FCE1EB6ECF19794370B983BC87029B2EAB4C8C5FC32F8154A9B9
                                                      Malicious:false
                                                      URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.PqO-Y4U4tl0.es5.O/ck=boq-identity.AccountsSignInUi.nq70RHujW6U.L.B1.O/am=xMFgKBm2EQjEH54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHcm_AmnkxyZDRYujxIEpRVVQs8wA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=n73qwf,SCuOPb,IZT63,vfuNJf,UUJqVe,ws9Tlc,siKnQd,XVq9Qb,STuCOe,njlZCf,m9oV,vjKJJ,y5vRwf,iyZMqd,NTMZac,mzzZzc,rCcCxc,vvMGie,K1ZKnb,ziZ8Mc,b3kMqb,mvkUhe,CMcBD,Fndnac,t2srLd,EN3i8d,z0u0L,xiZRqc,NOeYWe,O6y8ed,L9OGUe,PrPYRd,MpJwZc,qPfo0c,cYShmd,hc6Ubd,Rkm0ef,KUM7Z,oLggrd,inNHtf,L1AAkb,WpP9Yc,lwddkf,gJzDyc,SpsfSb,aC1iue,tUnxGc,aW3pY,ZakeSe,EFQ78c,xQtZb,I6YDgd,zbML3c,zr1jrb,vHEMJe,YHI3We,YTxL4,bSspM,Uas9Hd,zy0vNb,K0PMbc,AvtSve,qmdT9,MY7mZe,xBaz7b,GwYlN,eVCnO,EIOG1e,LDQI"
                                                      Preview:"use strict";_F_installCss(".r4WGQb{position:relative}.Dl08I>:first-child{margin-top:0}.Dl08I>:last-child{margin-bottom:0}.IzwVE{color:#1f1f1f;color:var(--gm3-sys-color-on-surface,#1f1f1f);font-family:\"Google Sans\",roboto,\"Noto Sans Myanmar UI\",arial,sans-serif;font-size:1.25rem;font-weight:400;letter-spacing:0rem;line-height:1.2}.l5PPKe{color:#1f1f1f;color:var(--gm3-sys-color-on-surface,#1f1f1f);font-size:1rem}.l5PPKe .dMNVAe{margin:0;padding:0}.l5PPKe>:first-child{margin-top:0;padding-top:0}.l5PPKe>:last-child{margin-bottom:0;padding-bottom:0}.Dl08I{margin:0;padding:0;position:relative}.Dl08I>.SmR8:only-child{padding-top:1px}.Dl08I>.SmR8:only-child::before{top:0}.Dl08I>.SmR8:not(first-child){padding-bottom:1px}.Dl08I>.SmR8::after{bottom:0}.Dl08I>.SmR8:only-child::before,.Dl08I>.SmR8::after{border-bottom:1px solid #c4c7c5;border-bottom:1px solid var(--gm3-sys-color-outline-variant,#c4c7c5);content:\"\";height:0;left:0;position:absolute;width:100%}.aZvCDf{margin-top:8px;margin-left

                                                      Chrome Cache Entry: 150

                                                      Download File
                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      File Type:ASCII text, with very long lines (570)
                                                      Category:downloaded
                                                      Size (bytes):3467
                                                      Entropy (8bit):5.508385764606741
                                                      Encrypted:false
                                                      SSDEEP:96:ogbsxK3SrI2Jrutmxy9FALtcP+EGYkxhclzV9xCw:Psc3OIpDj2ZYkxhATxX
                                                      MD5:231ABD6E6C360E709640B399EDF85476
                                                      SHA1:6CB98F38D9B6FDCF2E7D7C7682A219082F2E1E75
                                                      SHA-256:44B5D535663C65CD2E6228EF1F0C3DBA9C89EAE5C1BF079A6C4C64972DEE989D
                                                      SHA-512:D45455810B34493A05BA2DD7ADF24C0C009F4CF0898AE9C57978D38C8F2654CEEFC11D1C151BA72B902E0FA87537D43C37957DCAEC1792B5277B54C8E7BCCA3C
                                                      Malicious:false
                                                      URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.PqO-Y4U4tl0.es5.O/ck=boq-identity.AccountsSignInUi.nq70RHujW6U.L.B1.O/am=xMFgKBm2EQjEH54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,iAskyc,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,wg1P6b,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziXSP,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHcm_AmnkxyZDRYujxIEpRVVQs8wA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=Wt6vjf,hhhU8,FCpbqb,WhJNk"
                                                      Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.k("Wt6vjf");.var fya=function(){var a=_.He();return _.Nj(a,1)},au=function(a){this.Da=_.t(a,0,au.messageId)};_.J(au,_.v);au.prototype.Ha=function(){return _.Fj(this,1)};au.prototype.Ua=function(a){return _.Xj(this,1,a)};au.messageId="f.bo";var bu=function(){_.km.call(this)};_.J(bu,_.km);bu.prototype.xd=function(){this.NT=!1;gya(this);_.km.prototype.xd.call(this)};bu.prototype.aa=function(){hya(this);if(this.JC)return iya(this),!1;if(!this.UV)return cu(this),!0;this.dispatchEvent("p");if(!this.HP)return cu(this),!0;this.NM?(this.dispatchEvent("r"),cu(this)):iya(this);return!1};.var jya=function(a){var b=new _.gp(a.b5);a.vQ!=null&&_.Mn(b,"authuser",a.vQ);return b},iya=function(a){a.JC=!0;var b=jya(a),c="rt=r&f_uid="+_.rk(a.HP);_.fn(b,(0,_.bg)(a.ea,a),"POST",c)};.bu.prototype.ea=function(a){a=a.target;hya(this);if(_.jn(a)){this.iK=0;if(this.NM)this.JC=!1,this.dispatchEvent("r"

                                                      Chrome Cache Entry: 151

                                                      Download File
                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      File Type:ASCII text, with very long lines (395)
                                                      Category:downloaded
                                                      Size (bytes):1608
                                                      Entropy (8bit):5.271783084011668
                                                      Encrypted:false
                                                      SSDEEP:48:o726BiFP89yAxKz1TtMxII+eXww7D2bc+rw:oyMyAAz1WNd8vw
                                                      MD5:45EA91A811A594F81B7F760DD14BE237
                                                      SHA1:2C97782C6D5D0BCFB3676FF24AA1008251090DAE
                                                      SHA-256:7488FF4710E7592F66BE1FAC090F73CB8F1D2D0794B57DEAC1798C5B309EE76F
                                                      SHA-512:4F79A36857D5A8AF1E2F938EF92EA75C384DE4789972B068BE82EADAA442C538A65035CCE8665A7283137E2075B8FE4C1C9E7B2A36585491683B4869005B772A
                                                      Malicious:false
                                                      URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.PqO-Y4U4tl0.es5.O/ck=boq-identity.AccountsSignInUi.nq70RHujW6U.L.B1.O/am=xMFgKBm2EQjEH54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHcm_AmnkxyZDRYujxIEpRVVQs8wA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=w9hDv,ZDZcre,A7fCU"
                                                      Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.k("w9hDv");._.vg(_.Ila);_.iA=function(a){_.W.call(this,a.Fa);this.aa=a.Xa.cache};_.J(_.iA,_.W);_.iA.Ba=function(){return{Xa:{cache:_.gt}}};_.iA.prototype.execute=function(a){_.Bb(a,function(b){var c;_.$e(b)&&(c=b.eb.kc(b.kb));c&&this.aa.LG(c)},this);return{}};_.qu(_.Ola,_.iA);._.l();._.k("ZDZcre");.var jH=function(a){_.W.call(this,a.Fa);this.Xl=a.Ea.Xl;this.j4=a.Ea.metadata;this.aa=a.Ea.wt};_.J(jH,_.W);jH.Ba=function(){return{Ea:{Xl:_.OG,metadata:_.b_a,wt:_.LG}}};jH.prototype.execute=function(a){var b=this;a=this.aa.create(a);return _.Bb(a,function(c){var d=b.j4.getType(c.Od())===2?b.Xl.Rb(c):b.Xl.fetch(c);return _.Bl(c,_.PG)?d.then(function(e){return _.Dd(e)}):d},this)};_.qu(_.Tla,jH);._.l();._.k("K5nYTd");._.a_a=new _.pf(_.Pla);._.l();._.k("sP4Vbe");.._.l();._.k("kMFpHd");.._.l();._.k("A7fCU");.var RG=function(a){_.W.call(this,a.Fa);this.aa=a.Ea.yQ};_.J(RG,_.W);RG.Ba=func

                                                      Chrome Cache Entry: 152

                                                      Download File
                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      File Type:ASCII text, with very long lines (755)
                                                      Category:downloaded
                                                      Size (bytes):1460
                                                      Entropy (8bit):5.274624539239422
                                                      Encrypted:false
                                                      SSDEEP:24:kMYD7DUuXIqMSsN7UYgtx/mQ7hz1BU6TZ6BdXDMvUKGbWxlGb+jSFFV87Ofk8tp8:o7DhXI6PoXwsKGb2lGb+jS9Mwrw
                                                      MD5:481C149C4D3EE4A53C3E7CBA067371DF
                                                      SHA1:E0FED275636D3492C922C44F010157FAF0936733
                                                      SHA-256:9327A53F577C5FCEFDB162E02D8646CE5B70DF2201F4B3289384657B32BACE70
                                                      SHA-512:EC5C5A03ED4E1A27BEE7E1C488A238D79A9787D944E364CCE516FB28C22256919E49C99BFCFEA0F7815AB4232A350914E26D33D20F5A81ED19A39DFD40E30C79
                                                      Malicious:false
                                                      URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.PqO-Y4U4tl0.es5.O/ck=boq-identity.AccountsSignInUi.nq70RHujW6U.L.B1.O/am=xMFgKBm2EQjEH54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHcm_AmnkxyZDRYujxIEpRVVQs8wA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=P6sQOc"
                                                      Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.k("lOO0Vd");._.b_a=new _.pf(_.Dm);._.l();._.k("P6sQOc");.var g_a=!!(_.Mh[1]&16);var i_a=function(a,b,c,d,e){this.ea=a;this.xa=b;this.ka=c;this.Ca=d;this.Ga=e;this.aa=0;this.da=h_a(this)},j_a=function(a){var b={};_.Ma(a.HS(),function(e){b[e]=!0});var c=a.uS(),d=a.yS();return new i_a(a.wP(),c.aa()*1E3,a.bS(),d.aa()*1E3,b)},h_a=function(a){return Math.random()*Math.min(a.xa*Math.pow(a.ka,a.aa),a.Ca)},SG=function(a,b){return a.aa>=a.ea?!1:b!=null?!!a.Ga[b]:!0};var TG=function(a){_.W.call(this,a.Fa);this.da=a.Ea.JV;this.ea=a.Ea.metadata;a=a.Ea.cha;this.fetch=a.fetch.bind(a)};_.J(TG,_.W);TG.Ba=function(){return{Ea:{JV:_.e_a,metadata:_.b_a,cha:_.VZa}}};TG.prototype.aa=function(a,b){if(this.ea.getType(a.Od())!==1)return _.Vm(a);var c=this.da.jV;return(c=c?j_a(c):null)&&SG(c)?_.zya(a,k_a(this,a,b,c)):_.Vm(a)};.var k_a=function(a,b,c,d){return c.then(function(e){return e},function(e)

                                                      Chrome Cache Entry: 153

                                                      Download File
                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      File Type:ASCII text, with no line terminators
                                                      Category:downloaded
                                                      Size (bytes):84
                                                      Entropy (8bit):4.875266466142591
                                                      Encrypted:false
                                                      SSDEEP:3:DZFJu0+WVTBCq2Bjdw2KsJJuYHSKnZ:lFJuuVTBudw29nu4SKZ
                                                      MD5:87B6333E98B7620EA1FF98D1A837A39E
                                                      SHA1:105DE6815B0885357DE1414BFC0D77FCC9E924EF
                                                      SHA-256:DCD3C133C5C40BECD4100BBE6EDAE84C9735E778E4234A5E8395C56FF8A733BA
                                                      SHA-512:867D7943D813685FAA76394E53199750C55817E836FD19C933F74D11E9657CE66719A6D6B2E39EE1DE62358BCE364E38A55F4E138DF92337DE6985DDCD5D0994
                                                      Malicious:false
                                                      URL:https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISHgmA6QC9dWevzxIFDRkBE_oSBQ3oIX6GEgUN05ioBw==?alt=proto
                                                      Preview:Cj0KBw0ZARP6GgAKKQ3oIX6GGgQISxgCKhwIClIYCg5AIS4jJF8qLSY/Ky8lLBABGP////8PCgcN05ioBxoA

                                                      Chrome Cache Entry: 154

                                                      Download File
                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      File Type:ASCII text, with very long lines (683)
                                                      Category:downloaded
                                                      Size (bytes):3131
                                                      Entropy (8bit):5.352056237104327
                                                      Encrypted:false
                                                      SSDEEP:48:o7hHD75byh9xqKP5jNQ8js63rAwrMNhYfmdpwoKLEy5aQW5Tx5v3MmFopMGIWO4x:oFD+95jOQr3AT7wRLDGD5flBb4Ew
                                                      MD5:ADEF03127F74F5E6742B8CFA7B863F28
                                                      SHA1:58D7C635582AF10E91EC047FD315FAF758AF51DA
                                                      SHA-256:5FDD639E222F58AEB6178EB02583086BCC50ED219DEAA953D0E7984DD0E1FEDC
                                                      SHA-512:3AC26E9569EE83298F386D551774F378D3E433A2C80C1D4BC7481C544605A2FA4943F6CBC8E97FBF8FE3C32C1EFB2A1CCAA01403819482FC7429538FDF2CA758
                                                      Malicious:false
                                                      URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.PqO-Y4U4tl0.es5.O/ck=boq-identity.AccountsSignInUi.nq70RHujW6U.L.B1.O/am=xMFgKBm2EQjEH54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHcm_AmnkxyZDRYujxIEpRVVQs8wA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ZwDk9d,RMhBfe"
                                                      Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.k("ZwDk9d");.var kA=function(a){_.W.call(this,a.Fa)};_.J(kA,_.W);kA.Ba=_.W.Ba;kA.prototype.jS=function(a){return _.Ye(this,{Xa:{lT:_.ol}}).then(function(b){var c=window._wjdd,d=window._wjdc;return!c&&d?new _.ni(function(e){window._wjdc=function(f){d(f);e(dKa(f,b,a))}}):dKa(c,b,a)})};var dKa=function(a,b,c){return(a=a&&a[c])?a:b.Xa.lT.jS(c)};.kA.prototype.aa=function(a,b){var c=_.Dra(b).Tj;if(c.startsWith("$")){var d=_.jm.get(a);_.xq[b]&&(d||(d={},_.jm.set(a,d)),d[c]=_.xq[b],delete _.xq[b],_.yq--);if(d)if(a=d[c])b=_.af(a);else throw Error("Jb`"+b);else b=null}else b=null;return b};_.qu(_.Lfa,kA);._.l();._.k("SNUn3");._.cKa=new _.pf(_.wg);._.l();._.k("RMhBfe");.var eKa=function(a){var b=_.wq(a);return b?new _.ni(function(c,d){var e=function(){b=_.wq(a);var f=_.Sfa(a,b);f?c(f.getAttribute("jsdata")):window.document.readyState=="complete"?(f=["Unable to find deferred jsdata wit

                                                      Chrome Cache Entry: 155

                                                      Download File
                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      File Type:ASCII text, with very long lines (2907)
                                                      Category:downloaded
                                                      Size (bytes):23298
                                                      Entropy (8bit):5.429186219736739
                                                      Encrypted:false
                                                      SSDEEP:384:+BitNeB9HVPQmqySWyvbbb/XEm6k1JTM2qzhOF0bCjOgiQBH2f+wl9nyf0zHwx:+BiHeB9Hecebbb/PONOFnjOgPBHgSywx
                                                      MD5:A5C41D7BA22E9CF451810802AE5AC2E8
                                                      SHA1:858F35134A0BD7BAECB1B1A30EC3645642214554
                                                      SHA-256:D29364A1E9EDE91152F2CB84962B73644741817C9C6A615C1FB70A885DD1CB8D
                                                      SHA-512:DEA28AD362B51832D33CD9E936C0A255FA32C20DFFC6E806DA7AAF657D3490AF079C40FE21E10B2FDC971EB066E51ABDA182DEDC156759CCE06440E456FEB316
                                                      Malicious:false
                                                      URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.PqO-Y4U4tl0.es5.O/ck=boq-identity.AccountsSignInUi.nq70RHujW6U.L.B1.O/am=xMFgKBm2EQjEH54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHcm_AmnkxyZDRYujxIEpRVVQs8wA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=RqjULd"
                                                      Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.xu.prototype.da=_.ca(40,function(){return _.tj(this,3)});_.cz=function(a,b){this.key=a;this.defaultValue=!1;this.flagName=b};_.cz.prototype.ctor=function(a){return typeof a==="boolean"?a:this.defaultValue};_.dz=function(){this.ka=!0;var a=_.xj(_.fk(_.Be("TSDtV",window),_.Cya),_.xu,1,_.sj())[0];if(a){var b={};for(var c=_.n(_.xj(a,_.Dya,2,_.sj())),d=c.next();!d.done;d=c.next()){d=d.value;var e=_.Lj(d,1).toString();switch(_.vj(d,_.yu)){case 3:b[e]=_.Jj(d,_.nj(d,_.yu,3));break;case 2:b[e]=_.Lj(d,_.nj(d,_.yu,2));break;case 4:b[e]=_.Mj(d,_.nj(d,_.yu,4));break;case 5:b[e]=_.Nj(d,_.nj(d,_.yu,5));break;case 6:b[e]=_.Rj(d,_.ff,6,_.yu);break;default:throw Error("jd`"+_.vj(d,_.yu));}}}else b={};this.ea=b;this.token=.a?a.da():null};_.dz.prototype.aa=function(a){if(!this.ka||a.key in this.ea)a=a.ctor(this.ea[a.key]);else if(_.Be("nQyAE",window)){var b=_.Fya(a.flagName);if(b===null)a=a.de

                                                      Static File Info

                                                      General

                                                      File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Entropy (8bit):6.583817157993573
                                                      TrID:
                                                      • Win32 Executable (generic) a (10002005/4) 99.96%
                                                      • Generic Win/DOS Executable (2004/3) 0.02%
                                                      • DOS Executable Generic (2002/1) 0.02%
                                                      • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                      File name:file.exe
                                                      File size:919'040 bytes
                                                      MD5:6d09b95cc7d01afe4997af5e6e550580
                                                      SHA1:4d1727ef778c9516274e0beb383c22b1282382fa
                                                      SHA256:ca2858de41af6f9b91bafd74fbb004bf30a313701f14118406f091822f9ae635
                                                      SHA512:15cb29574f840ac731cfaa97be87c7cc4def1531e3cfd2ede8f7ba436b92470e35aeef3cd09e802e160b28cad6979097523624196ea752d6c7bc08d3b075c6a7
                                                      SSDEEP:24576:FqDEvCTbMWu7rQYlBQcBiT6rprG8a4VK:FTvC/MTQYxsWR7a4
                                                      TLSH:8F159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3
                                                      File Content Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z....

                                                      File Icon

                                                      Icon Hash:aaf3e3e3938382a0

                                                      Static PE Info

                                                      General

                                                      Entrypoint:0x420577
                                                      Entrypoint Section:.text
                                                      Digitally signed:false
                                                      Imagebase:0x400000
                                                      Subsystem:windows gui
                                                      Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                                                      DLL Characteristics:DYNAMIC_BASE, TERMINAL_SERVER_AWARE
                                                      Time Stamp:0x6703C211 [Mon Oct 7 11:12:17 2024 UTC]
                                                      TLS Callbacks:
                                                      CLR (.Net) Version:
                                                      OS Version Major:5
                                                      OS Version Minor:1
                                                      File Version Major:5
                                                      File Version Minor:1
                                                      Subsystem Version Major:5
                                                      Subsystem Version Minor:1
                                                      Import Hash:948cc502fe9226992dce9417f952fce3

                                                      Entrypoint Preview

                                                      Instruction
                                                      call 00007F21253CE5B3h
                                                      jmp 00007F21253CDEBFh
                                                      push ebp
                                                      mov ebp, esp
                                                      push esi
                                                      push dword ptr [ebp+08h]
                                                      mov esi, ecx
                                                      call 00007F21253CE09Dh
                                                      mov dword ptr [esi], 0049FDF0h
                                                      mov eax, esi
                                                      pop esi
                                                      pop ebp
                                                      retn 0004h
                                                      and dword ptr [ecx+04h], 00000000h
                                                      mov eax, ecx
                                                      and dword ptr [ecx+08h], 00000000h
                                                      mov dword ptr [ecx+04h], 0049FDF8h
                                                      mov dword ptr [ecx], 0049FDF0h
                                                      ret
                                                      push ebp
                                                      mov ebp, esp
                                                      push esi
                                                      push dword ptr [ebp+08h]
                                                      mov esi, ecx
                                                      call 00007F21253CE06Ah
                                                      mov dword ptr [esi], 0049FE0Ch
                                                      mov eax, esi
                                                      pop esi
                                                      pop ebp
                                                      retn 0004h
                                                      and dword ptr [ecx+04h], 00000000h
                                                      mov eax, ecx
                                                      and dword ptr [ecx+08h], 00000000h
                                                      mov dword ptr [ecx+04h], 0049FE14h
                                                      mov dword ptr [ecx], 0049FE0Ch
                                                      ret
                                                      push ebp
                                                      mov ebp, esp
                                                      push esi
                                                      mov esi, ecx
                                                      lea eax, dword ptr [esi+04h]
                                                      mov dword ptr [esi], 0049FDD0h
                                                      and dword ptr [eax], 00000000h
                                                      and dword ptr [eax+04h], 00000000h
                                                      push eax
                                                      mov eax, dword ptr [ebp+08h]
                                                      add eax, 04h
                                                      push eax
                                                      call 00007F21253D0C5Dh
                                                      pop ecx
                                                      pop ecx
                                                      mov eax, esi
                                                      pop esi
                                                      pop ebp
                                                      retn 0004h
                                                      lea eax, dword ptr [ecx+04h]
                                                      mov dword ptr [ecx], 0049FDD0h
                                                      push eax
                                                      call 00007F21253D0CA8h
                                                      pop ecx
                                                      ret
                                                      push ebp
                                                      mov ebp, esp
                                                      push esi
                                                      mov esi, ecx
                                                      lea eax, dword ptr [esi+04h]
                                                      mov dword ptr [esi], 0049FDD0h
                                                      push eax
                                                      call 00007F21253D0C91h
                                                      test byte ptr [ebp+08h], 00000001h
                                                      pop ecx

                                                      Rich Headers

                                                      Programming Language:
                                                      • [ C ] VS2008 SP1 build 30729
                                                      • [IMP] VS2008 SP1 build 30729

                                                      Data Directories

                                                      NameVirtual AddressVirtual Size Is in Section
                                                      IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_IMPORT0xc8e640x17c.rdata
                                                      IMAGE_DIRECTORY_ENTRY_RESOURCE0xd40000x9bb8.rsrc
                                                      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_BASERELOC0xde0000x7594.reloc
                                                      IMAGE_DIRECTORY_ENTRY_DEBUG0xb0ff00x1c.rdata
                                                      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_TLS0xc34000x18.rdata
                                                      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0xb10100x40.rdata
                                                      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_IAT0x9c0000x894.rdata
                                                      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                      Sections

                                                      NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                      .text0x10000x9ab1d0x9ac000a1473f3064dcbc32ef93c5c8a90f3a6False0.565500681542811data6.668273581389308IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                      .rdata0x9c0000x2fb820x2fc00c9cf2468b60bf4f80f136ed54b3989fbFalse0.35289185209424084data5.691811547483722IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                      .data0xcc0000x706c0x480053b9025d545d65e23295e30afdbd16d9False0.04356553819444445DOS executable (block device driver @\273\)0.5846666986982398IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                      .rsrc0xd40000x9bb80x9c0002433c6f7371c17198457b0ac54bc272False0.3167317708333333data5.332639800350655IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                      .reloc0xde0000x75940x7600c68ee8931a32d45eb82dc450ee40efc3False0.7628111758474576data6.7972128181359786IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                      Resources

                                                      NameRVASizeTypeLanguageCountryZLIB Complexity
                                                      RT_ICON0xd45a80x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.7466216216216216
                                                      RT_ICON0xd46d00x128Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colorsEnglishGreat Britain0.3277027027027027
                                                      RT_ICON0xd47f80x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.3885135135135135
                                                      RT_ICON0xd49200x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 0EnglishGreat Britain0.3333333333333333
                                                      RT_ICON0xd4c080x128Device independent bitmap graphic, 16 x 32 x 4, image size 0EnglishGreat Britain0.5
                                                      RT_ICON0xd4d300xea8Device independent bitmap graphic, 48 x 96 x 8, image size 0EnglishGreat Britain0.2835820895522388
                                                      RT_ICON0xd5bd80x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 0EnglishGreat Britain0.37906137184115524
                                                      RT_ICON0xd64800x568Device independent bitmap graphic, 16 x 32 x 8, image size 0EnglishGreat Britain0.23699421965317918
                                                      RT_ICON0xd69e80x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 0EnglishGreat Britain0.13858921161825727
                                                      RT_ICON0xd8f900x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0EnglishGreat Britain0.25070356472795496
                                                      RT_ICON0xda0380x468Device independent bitmap graphic, 16 x 32 x 32, image size 0EnglishGreat Britain0.3173758865248227
                                                      RT_MENU0xda4a00x50dataEnglishGreat Britain0.9
                                                      RT_STRING0xda4f00x594dataEnglishGreat Britain0.3333333333333333
                                                      RT_STRING0xdaa840x68adataEnglishGreat Britain0.2735961768219833
                                                      RT_STRING0xdb1100x490dataEnglishGreat Britain0.3715753424657534
                                                      RT_STRING0xdb5a00x5fcdataEnglishGreat Britain0.3087467362924282
                                                      RT_STRING0xdbb9c0x65cdataEnglishGreat Britain0.34336609336609336
                                                      RT_STRING0xdc1f80x466dataEnglishGreat Britain0.3605683836589698
                                                      RT_STRING0xdc6600x158Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0EnglishGreat Britain0.502906976744186
                                                      RT_RCDATA0xdc7b80xe7edata1.002964959568733
                                                      RT_GROUP_ICON0xdd6380x76dataEnglishGreat Britain0.6610169491525424
                                                      RT_GROUP_ICON0xdd6b00x14dataEnglishGreat Britain1.25
                                                      RT_GROUP_ICON0xdd6c40x14dataEnglishGreat Britain1.15
                                                      RT_GROUP_ICON0xdd6d80x14dataEnglishGreat Britain1.25
                                                      RT_VERSION0xdd6ec0xdcdataEnglishGreat Britain0.6181818181818182
                                                      RT_MANIFEST0xdd7c80x3efASCII text, with CRLF line terminatorsEnglishGreat Britain0.5074478649453823

                                                      Imports

                                                      DLLImport
                                                      WSOCK32.dllgethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect
                                                      VERSION.dllGetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
                                                      WINMM.dlltimeGetTime, waveOutSetVolume, mciSendStringW
                                                      COMCTL32.dllImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
                                                      MPR.dllWNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W
                                                      WININET.dllHttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable
                                                      PSAPI.DLLGetProcessMemoryInfo
                                                      IPHLPAPI.DLLIcmpSendEcho, IcmpCloseHandle, IcmpCreateFile
                                                      USERENV.dllDestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile
                                                      UxTheme.dllIsThemeActive
                                                      KERNEL32.dllDuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW
                                                      USER32.dllGetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient
                                                      GDI32.dllEndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath
                                                      COMDLG32.dllGetSaveFileNameW, GetOpenFileNameW
                                                      ADVAPI32.dllGetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW
                                                      SHELL32.dllDragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW
                                                      ole32.dllCoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
                                                      OLEAUT32.dllCreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture

                                                      Possible Origin

                                                      Language of compilation systemCountry where language is spokenMap
                                                      EnglishGreat Britain

                                                      Network Behavior

                                                      Network Port Distribution

                                                      TCP Packets

                                                      TimestampSource PortDest PortSource IPDest IP
                                                      Oct 7, 2024 13:23:04.528593063 CEST49733443192.168.2.4172.217.16.142
                                                      Oct 7, 2024 13:23:04.528629065 CEST44349733172.217.16.142192.168.2.4
                                                      Oct 7, 2024 13:23:04.528687000 CEST49733443192.168.2.4172.217.16.142
                                                      Oct 7, 2024 13:23:04.529325962 CEST49733443192.168.2.4172.217.16.142
                                                      Oct 7, 2024 13:23:04.529339075 CEST44349733172.217.16.142192.168.2.4
                                                      Oct 7, 2024 13:23:04.536494017 CEST49675443192.168.2.4173.222.162.32
                                                      Oct 7, 2024 13:23:05.181480885 CEST44349733172.217.16.142192.168.2.4
                                                      Oct 7, 2024 13:23:05.181691885 CEST49733443192.168.2.4172.217.16.142
                                                      Oct 7, 2024 13:23:05.181704998 CEST44349733172.217.16.142192.168.2.4
                                                      Oct 7, 2024 13:23:05.183012009 CEST44349733172.217.16.142192.168.2.4
                                                      Oct 7, 2024 13:23:05.183084965 CEST49733443192.168.2.4172.217.16.142
                                                      Oct 7, 2024 13:23:05.185519934 CEST44349733172.217.16.142192.168.2.4
                                                      Oct 7, 2024 13:23:05.185637951 CEST49733443192.168.2.4172.217.16.142
                                                      Oct 7, 2024 13:23:05.186600924 CEST49733443192.168.2.4172.217.16.142
                                                      Oct 7, 2024 13:23:05.186683893 CEST44349733172.217.16.142192.168.2.4
                                                      Oct 7, 2024 13:23:05.186702013 CEST49733443192.168.2.4172.217.16.142
                                                      Oct 7, 2024 13:23:05.231400967 CEST44349733172.217.16.142192.168.2.4
                                                      Oct 7, 2024 13:23:05.239348888 CEST49733443192.168.2.4172.217.16.142
                                                      Oct 7, 2024 13:23:05.239362001 CEST44349733172.217.16.142192.168.2.4
                                                      Oct 7, 2024 13:23:05.286324978 CEST49733443192.168.2.4172.217.16.142
                                                      Oct 7, 2024 13:23:05.475133896 CEST44349733172.217.16.142192.168.2.4
                                                      Oct 7, 2024 13:23:05.475186110 CEST49733443192.168.2.4172.217.16.142
                                                      Oct 7, 2024 13:23:05.475193977 CEST44349733172.217.16.142192.168.2.4
                                                      Oct 7, 2024 13:23:05.475204945 CEST44349733172.217.16.142192.168.2.4
                                                      Oct 7, 2024 13:23:05.475239038 CEST49733443192.168.2.4172.217.16.142
                                                      Oct 7, 2024 13:23:05.503449917 CEST49733443192.168.2.4172.217.16.142
                                                      Oct 7, 2024 13:23:05.503469944 CEST44349733172.217.16.142192.168.2.4
                                                      Oct 7, 2024 13:23:05.715862036 CEST49736443192.168.2.4172.217.18.110
                                                      Oct 7, 2024 13:23:05.715920925 CEST44349736172.217.18.110192.168.2.4
                                                      Oct 7, 2024 13:23:05.716053009 CEST49736443192.168.2.4172.217.18.110
                                                      Oct 7, 2024 13:23:05.716563940 CEST49736443192.168.2.4172.217.18.110
                                                      Oct 7, 2024 13:23:05.716582060 CEST44349736172.217.18.110192.168.2.4
                                                      Oct 7, 2024 13:23:06.345452070 CEST44349736172.217.18.110192.168.2.4
                                                      Oct 7, 2024 13:23:06.346208096 CEST49736443192.168.2.4172.217.18.110
                                                      Oct 7, 2024 13:23:06.346219063 CEST44349736172.217.18.110192.168.2.4
                                                      Oct 7, 2024 13:23:06.346626997 CEST44349736172.217.18.110192.168.2.4
                                                      Oct 7, 2024 13:23:06.346770048 CEST49736443192.168.2.4172.217.18.110
                                                      Oct 7, 2024 13:23:06.347261906 CEST44349736172.217.18.110192.168.2.4
                                                      Oct 7, 2024 13:23:06.347412109 CEST49736443192.168.2.4172.217.18.110
                                                      Oct 7, 2024 13:23:06.348431110 CEST49736443192.168.2.4172.217.18.110
                                                      Oct 7, 2024 13:23:06.348517895 CEST44349736172.217.18.110192.168.2.4
                                                      Oct 7, 2024 13:23:06.348823071 CEST49736443192.168.2.4172.217.18.110
                                                      Oct 7, 2024 13:23:06.395402908 CEST44349736172.217.18.110192.168.2.4
                                                      Oct 7, 2024 13:23:06.395797968 CEST49736443192.168.2.4172.217.18.110
                                                      Oct 7, 2024 13:23:06.395808935 CEST44349736172.217.18.110192.168.2.4
                                                      Oct 7, 2024 13:23:06.442522049 CEST49736443192.168.2.4172.217.18.110
                                                      Oct 7, 2024 13:23:06.638897896 CEST44349736172.217.18.110192.168.2.4
                                                      Oct 7, 2024 13:23:06.638963938 CEST49736443192.168.2.4172.217.18.110
                                                      Oct 7, 2024 13:23:06.638977051 CEST44349736172.217.18.110192.168.2.4
                                                      Oct 7, 2024 13:23:06.638987064 CEST44349736172.217.18.110192.168.2.4
                                                      Oct 7, 2024 13:23:06.639025927 CEST49736443192.168.2.4172.217.18.110
                                                      Oct 7, 2024 13:23:06.641227007 CEST49736443192.168.2.4172.217.18.110
                                                      Oct 7, 2024 13:23:06.641241074 CEST44349736172.217.18.110192.168.2.4
                                                      Oct 7, 2024 13:23:08.894908905 CEST49741443192.168.2.4142.250.185.68
                                                      Oct 7, 2024 13:23:08.894962072 CEST44349741142.250.185.68192.168.2.4
                                                      Oct 7, 2024 13:23:08.895415068 CEST49741443192.168.2.4142.250.185.68
                                                      Oct 7, 2024 13:23:08.895415068 CEST49741443192.168.2.4142.250.185.68
                                                      Oct 7, 2024 13:23:08.895456076 CEST44349741142.250.185.68192.168.2.4
                                                      Oct 7, 2024 13:23:09.465843916 CEST49742443192.168.2.4184.28.90.27
                                                      Oct 7, 2024 13:23:09.465905905 CEST44349742184.28.90.27192.168.2.4
                                                      Oct 7, 2024 13:23:09.465975046 CEST49742443192.168.2.4184.28.90.27
                                                      Oct 7, 2024 13:23:09.510137081 CEST49742443192.168.2.4184.28.90.27
                                                      Oct 7, 2024 13:23:09.510181904 CEST44349742184.28.90.27192.168.2.4
                                                      Oct 7, 2024 13:23:09.567428112 CEST44349741142.250.185.68192.168.2.4
                                                      Oct 7, 2024 13:23:09.568993092 CEST49741443192.168.2.4142.250.185.68
                                                      Oct 7, 2024 13:23:09.569017887 CEST44349741142.250.185.68192.168.2.4
                                                      Oct 7, 2024 13:23:09.570040941 CEST44349741142.250.185.68192.168.2.4
                                                      Oct 7, 2024 13:23:09.570172071 CEST49741443192.168.2.4142.250.185.68
                                                      Oct 7, 2024 13:23:09.571271896 CEST49741443192.168.2.4142.250.185.68
                                                      Oct 7, 2024 13:23:09.571347952 CEST44349741142.250.185.68192.168.2.4
                                                      Oct 7, 2024 13:23:09.622920990 CEST49741443192.168.2.4142.250.185.68
                                                      Oct 7, 2024 13:23:09.622931957 CEST44349741142.250.185.68192.168.2.4
                                                      Oct 7, 2024 13:23:09.676665068 CEST49741443192.168.2.4142.250.185.68
                                                      Oct 7, 2024 13:23:10.168644905 CEST44349742184.28.90.27192.168.2.4
                                                      Oct 7, 2024 13:23:10.168765068 CEST49742443192.168.2.4184.28.90.27
                                                      Oct 7, 2024 13:23:10.216880083 CEST49742443192.168.2.4184.28.90.27
                                                      Oct 7, 2024 13:23:10.216933966 CEST44349742184.28.90.27192.168.2.4
                                                      Oct 7, 2024 13:23:10.217379093 CEST44349742184.28.90.27192.168.2.4
                                                      Oct 7, 2024 13:23:10.267265081 CEST49742443192.168.2.4184.28.90.27
                                                      Oct 7, 2024 13:23:10.311412096 CEST44349742184.28.90.27192.168.2.4
                                                      Oct 7, 2024 13:23:10.455351114 CEST44349742184.28.90.27192.168.2.4
                                                      Oct 7, 2024 13:23:10.455461979 CEST44349742184.28.90.27192.168.2.4
                                                      Oct 7, 2024 13:23:10.455532074 CEST49742443192.168.2.4184.28.90.27
                                                      Oct 7, 2024 13:23:10.456393957 CEST49742443192.168.2.4184.28.90.27
                                                      Oct 7, 2024 13:23:10.456420898 CEST44349742184.28.90.27192.168.2.4
                                                      Oct 7, 2024 13:23:10.456438065 CEST49742443192.168.2.4184.28.90.27
                                                      Oct 7, 2024 13:23:10.456446886 CEST44349742184.28.90.27192.168.2.4
                                                      Oct 7, 2024 13:23:10.497435093 CEST49745443192.168.2.4184.28.90.27
                                                      Oct 7, 2024 13:23:10.497488976 CEST44349745184.28.90.27192.168.2.4
                                                      Oct 7, 2024 13:23:10.497556925 CEST49745443192.168.2.4184.28.90.27
                                                      Oct 7, 2024 13:23:10.497879982 CEST49745443192.168.2.4184.28.90.27
                                                      Oct 7, 2024 13:23:10.497898102 CEST44349745184.28.90.27192.168.2.4
                                                      Oct 7, 2024 13:23:11.134789944 CEST44349745184.28.90.27192.168.2.4
                                                      Oct 7, 2024 13:23:11.134875059 CEST49745443192.168.2.4184.28.90.27
                                                      Oct 7, 2024 13:23:11.137320042 CEST49745443192.168.2.4184.28.90.27
                                                      Oct 7, 2024 13:23:11.137331963 CEST44349745184.28.90.27192.168.2.4
                                                      Oct 7, 2024 13:23:11.137651920 CEST44349745184.28.90.27192.168.2.4
                                                      Oct 7, 2024 13:23:11.139616013 CEST49745443192.168.2.4184.28.90.27
                                                      Oct 7, 2024 13:23:11.187408924 CEST44349745184.28.90.27192.168.2.4
                                                      Oct 7, 2024 13:23:11.410866976 CEST44349745184.28.90.27192.168.2.4
                                                      Oct 7, 2024 13:23:11.410945892 CEST44349745184.28.90.27192.168.2.4
                                                      Oct 7, 2024 13:23:11.411873102 CEST49745443192.168.2.4184.28.90.27
                                                      Oct 7, 2024 13:23:11.412276983 CEST49745443192.168.2.4184.28.90.27
                                                      Oct 7, 2024 13:23:11.412295103 CEST44349745184.28.90.27192.168.2.4
                                                      Oct 7, 2024 13:23:11.412305117 CEST49745443192.168.2.4184.28.90.27
                                                      Oct 7, 2024 13:23:11.412309885 CEST44349745184.28.90.27192.168.2.4
                                                      Oct 7, 2024 13:23:14.758124113 CEST49757443192.168.2.4216.58.206.46
                                                      Oct 7, 2024 13:23:14.758172035 CEST44349757216.58.206.46192.168.2.4
                                                      Oct 7, 2024 13:23:14.758220911 CEST49757443192.168.2.4216.58.206.46
                                                      Oct 7, 2024 13:23:14.758918047 CEST49757443192.168.2.4216.58.206.46
                                                      Oct 7, 2024 13:23:14.758938074 CEST44349757216.58.206.46192.168.2.4
                                                      Oct 7, 2024 13:23:15.390243053 CEST44349757216.58.206.46192.168.2.4
                                                      Oct 7, 2024 13:23:15.390512943 CEST49757443192.168.2.4216.58.206.46
                                                      Oct 7, 2024 13:23:15.390536070 CEST44349757216.58.206.46192.168.2.4
                                                      Oct 7, 2024 13:23:15.391083956 CEST44349757216.58.206.46192.168.2.4
                                                      Oct 7, 2024 13:23:15.391153097 CEST49757443192.168.2.4216.58.206.46
                                                      Oct 7, 2024 13:23:15.392123938 CEST44349757216.58.206.46192.168.2.4
                                                      Oct 7, 2024 13:23:15.392174006 CEST49757443192.168.2.4216.58.206.46
                                                      Oct 7, 2024 13:23:15.393068075 CEST49757443192.168.2.4216.58.206.46
                                                      Oct 7, 2024 13:23:15.393155098 CEST44349757216.58.206.46192.168.2.4
                                                      Oct 7, 2024 13:23:15.393275976 CEST49757443192.168.2.4216.58.206.46
                                                      Oct 7, 2024 13:23:15.393287897 CEST44349757216.58.206.46192.168.2.4
                                                      Oct 7, 2024 13:23:15.443094969 CEST49757443192.168.2.4216.58.206.46
                                                      Oct 7, 2024 13:23:15.707657099 CEST44349757216.58.206.46192.168.2.4
                                                      Oct 7, 2024 13:23:15.707721949 CEST44349757216.58.206.46192.168.2.4
                                                      Oct 7, 2024 13:23:15.707772017 CEST49757443192.168.2.4216.58.206.46
                                                      Oct 7, 2024 13:23:15.707792044 CEST44349757216.58.206.46192.168.2.4
                                                      Oct 7, 2024 13:23:15.707832098 CEST49757443192.168.2.4216.58.206.46
                                                      Oct 7, 2024 13:23:15.707848072 CEST44349757216.58.206.46192.168.2.4
                                                      Oct 7, 2024 13:23:15.707889080 CEST49757443192.168.2.4216.58.206.46
                                                      Oct 7, 2024 13:23:15.713871002 CEST44349757216.58.206.46192.168.2.4
                                                      Oct 7, 2024 13:23:15.713942051 CEST49757443192.168.2.4216.58.206.46
                                                      Oct 7, 2024 13:23:15.719995022 CEST44349757216.58.206.46192.168.2.4
                                                      Oct 7, 2024 13:23:15.720050097 CEST44349757216.58.206.46192.168.2.4
                                                      Oct 7, 2024 13:23:15.720067978 CEST49757443192.168.2.4216.58.206.46
                                                      Oct 7, 2024 13:23:15.720078945 CEST44349757216.58.206.46192.168.2.4
                                                      Oct 7, 2024 13:23:15.720118999 CEST49757443192.168.2.4216.58.206.46
                                                      Oct 7, 2024 13:23:15.726274014 CEST44349757216.58.206.46192.168.2.4
                                                      Oct 7, 2024 13:23:15.726337910 CEST49757443192.168.2.4216.58.206.46
                                                      Oct 7, 2024 13:23:15.732672930 CEST44349757216.58.206.46192.168.2.4
                                                      Oct 7, 2024 13:23:15.732727051 CEST44349757216.58.206.46192.168.2.4
                                                      Oct 7, 2024 13:23:15.732744932 CEST49757443192.168.2.4216.58.206.46
                                                      Oct 7, 2024 13:23:15.732753038 CEST44349757216.58.206.46192.168.2.4
                                                      Oct 7, 2024 13:23:15.732793093 CEST49757443192.168.2.4216.58.206.46
                                                      Oct 7, 2024 13:23:15.794301033 CEST44349757216.58.206.46192.168.2.4
                                                      Oct 7, 2024 13:23:15.794351101 CEST44349757216.58.206.46192.168.2.4
                                                      Oct 7, 2024 13:23:15.794383049 CEST49757443192.168.2.4216.58.206.46
                                                      Oct 7, 2024 13:23:15.794394970 CEST44349757216.58.206.46192.168.2.4
                                                      Oct 7, 2024 13:23:15.794433117 CEST49757443192.168.2.4216.58.206.46
                                                      Oct 7, 2024 13:23:15.797189951 CEST44349757216.58.206.46192.168.2.4
                                                      Oct 7, 2024 13:23:15.797239065 CEST49757443192.168.2.4216.58.206.46
                                                      Oct 7, 2024 13:23:15.803509951 CEST44349757216.58.206.46192.168.2.4
                                                      Oct 7, 2024 13:23:15.803554058 CEST44349757216.58.206.46192.168.2.4
                                                      Oct 7, 2024 13:23:15.803576946 CEST49757443192.168.2.4216.58.206.46
                                                      Oct 7, 2024 13:23:15.803585052 CEST44349757216.58.206.46192.168.2.4
                                                      Oct 7, 2024 13:23:15.803622961 CEST49757443192.168.2.4216.58.206.46
                                                      Oct 7, 2024 13:23:15.809968948 CEST44349757216.58.206.46192.168.2.4
                                                      Oct 7, 2024 13:23:15.810041904 CEST49757443192.168.2.4216.58.206.46
                                                      Oct 7, 2024 13:23:15.815932035 CEST44349757216.58.206.46192.168.2.4
                                                      Oct 7, 2024 13:23:15.815996885 CEST49757443192.168.2.4216.58.206.46
                                                      Oct 7, 2024 13:23:15.816009045 CEST44349757216.58.206.46192.168.2.4
                                                      Oct 7, 2024 13:23:15.822482109 CEST44349757216.58.206.46192.168.2.4
                                                      Oct 7, 2024 13:23:15.822530985 CEST49757443192.168.2.4216.58.206.46
                                                      Oct 7, 2024 13:23:15.822540045 CEST44349757216.58.206.46192.168.2.4
                                                      Oct 7, 2024 13:23:15.828613043 CEST44349757216.58.206.46192.168.2.4
                                                      Oct 7, 2024 13:23:15.828672886 CEST49757443192.168.2.4216.58.206.46
                                                      Oct 7, 2024 13:23:15.828681946 CEST44349757216.58.206.46192.168.2.4
                                                      Oct 7, 2024 13:23:15.828744888 CEST44349757216.58.206.46192.168.2.4
                                                      Oct 7, 2024 13:23:15.828799009 CEST49757443192.168.2.4216.58.206.46
                                                      Oct 7, 2024 13:23:15.828952074 CEST49757443192.168.2.4216.58.206.46
                                                      Oct 7, 2024 13:23:15.828967094 CEST44349757216.58.206.46192.168.2.4
                                                      Oct 7, 2024 13:23:18.173927069 CEST49741443192.168.2.4142.250.185.68
                                                      Oct 7, 2024 13:23:18.186367035 CEST49769443192.168.2.44.175.87.197
                                                      Oct 7, 2024 13:23:18.186398983 CEST443497694.175.87.197192.168.2.4
                                                      Oct 7, 2024 13:23:18.186484098 CEST49769443192.168.2.44.175.87.197
                                                      Oct 7, 2024 13:23:18.187752008 CEST49769443192.168.2.44.175.87.197
                                                      Oct 7, 2024 13:23:18.187771082 CEST443497694.175.87.197192.168.2.4
                                                      Oct 7, 2024 13:23:18.219400883 CEST44349741142.250.185.68192.168.2.4
                                                      Oct 7, 2024 13:23:18.375976086 CEST44349741142.250.185.68192.168.2.4
                                                      Oct 7, 2024 13:23:18.376024008 CEST44349741142.250.185.68192.168.2.4
                                                      Oct 7, 2024 13:23:18.376054049 CEST44349741142.250.185.68192.168.2.4
                                                      Oct 7, 2024 13:23:18.376085043 CEST44349741142.250.185.68192.168.2.4
                                                      Oct 7, 2024 13:23:18.376091003 CEST49741443192.168.2.4142.250.185.68
                                                      Oct 7, 2024 13:23:18.376106024 CEST44349741142.250.185.68192.168.2.4
                                                      Oct 7, 2024 13:23:18.376127005 CEST49741443192.168.2.4142.250.185.68
                                                      Oct 7, 2024 13:23:18.376240969 CEST44349741142.250.185.68192.168.2.4
                                                      Oct 7, 2024 13:23:18.376283884 CEST49741443192.168.2.4142.250.185.68
                                                      Oct 7, 2024 13:23:18.377711058 CEST49741443192.168.2.4142.250.185.68
                                                      Oct 7, 2024 13:23:18.377723932 CEST44349741142.250.185.68192.168.2.4
                                                      Oct 7, 2024 13:23:18.974919081 CEST443497694.175.87.197192.168.2.4
                                                      Oct 7, 2024 13:23:18.975003004 CEST49769443192.168.2.44.175.87.197
                                                      Oct 7, 2024 13:23:18.977768898 CEST49769443192.168.2.44.175.87.197
                                                      Oct 7, 2024 13:23:18.977788925 CEST443497694.175.87.197192.168.2.4
                                                      Oct 7, 2024 13:23:18.978096008 CEST443497694.175.87.197192.168.2.4
                                                      Oct 7, 2024 13:23:19.021138906 CEST49769443192.168.2.44.175.87.197
                                                      Oct 7, 2024 13:23:19.681885004 CEST49769443192.168.2.44.175.87.197
                                                      Oct 7, 2024 13:23:19.690308094 CEST4972380192.168.2.488.221.110.91
                                                      Oct 7, 2024 13:23:19.695836067 CEST804972388.221.110.91192.168.2.4
                                                      Oct 7, 2024 13:23:19.696990967 CEST4972380192.168.2.488.221.110.91
                                                      Oct 7, 2024 13:23:19.727401018 CEST443497694.175.87.197192.168.2.4
                                                      Oct 7, 2024 13:23:19.941046953 CEST443497694.175.87.197192.168.2.4
                                                      Oct 7, 2024 13:23:19.941076040 CEST443497694.175.87.197192.168.2.4
                                                      Oct 7, 2024 13:23:19.941083908 CEST443497694.175.87.197192.168.2.4
                                                      Oct 7, 2024 13:23:19.941097021 CEST443497694.175.87.197192.168.2.4
                                                      Oct 7, 2024 13:23:19.941133022 CEST443497694.175.87.197192.168.2.4
                                                      Oct 7, 2024 13:23:19.941159964 CEST49769443192.168.2.44.175.87.197
                                                      Oct 7, 2024 13:23:19.941203117 CEST443497694.175.87.197192.168.2.4
                                                      Oct 7, 2024 13:23:19.941221952 CEST49769443192.168.2.44.175.87.197
                                                      Oct 7, 2024 13:23:19.941248894 CEST49769443192.168.2.44.175.87.197
                                                      Oct 7, 2024 13:23:19.941800117 CEST443497694.175.87.197192.168.2.4
                                                      Oct 7, 2024 13:23:19.941855907 CEST49769443192.168.2.44.175.87.197
                                                      Oct 7, 2024 13:23:19.941867113 CEST443497694.175.87.197192.168.2.4
                                                      Oct 7, 2024 13:23:19.941999912 CEST443497694.175.87.197192.168.2.4
                                                      Oct 7, 2024 13:23:19.942044020 CEST49769443192.168.2.44.175.87.197
                                                      Oct 7, 2024 13:23:20.704948902 CEST49769443192.168.2.44.175.87.197
                                                      Oct 7, 2024 13:23:20.704967022 CEST443497694.175.87.197192.168.2.4
                                                      Oct 7, 2024 13:23:20.705192089 CEST49769443192.168.2.44.175.87.197
                                                      Oct 7, 2024 13:23:20.705198050 CEST443497694.175.87.197192.168.2.4
                                                      Oct 7, 2024 13:23:54.508744955 CEST49784443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:54.508770943 CEST4434978413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:54.508831978 CEST49784443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:54.509078979 CEST49784443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:54.509089947 CEST4434978413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:55.201886892 CEST4434978413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:55.202018976 CEST49784443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:55.205323935 CEST49784443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:55.205342054 CEST4434978413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:55.205719948 CEST4434978413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:55.213903904 CEST49784443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:55.259396076 CEST4434978413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:55.641782999 CEST4434978413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:55.641808033 CEST4434978413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:55.641833067 CEST4434978413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:55.641937017 CEST49784443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:55.641943932 CEST4434978413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:55.641993046 CEST49784443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:55.733613014 CEST4434978413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:55.733639956 CEST4434978413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:55.733705997 CEST49784443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:55.733726025 CEST4434978413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:55.733792067 CEST49784443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:55.736105919 CEST4434978413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:55.736136913 CEST4434978413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:55.736187935 CEST49784443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:55.736196995 CEST4434978413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:55.736207962 CEST49784443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:55.736234903 CEST49784443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:55.825222015 CEST4434978413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:55.825254917 CEST4434978413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:55.825396061 CEST49784443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:55.825423956 CEST4434978413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:55.825474977 CEST49784443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:55.826277018 CEST4434978413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:55.826299906 CEST4434978413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:55.826356888 CEST49784443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:55.826371908 CEST4434978413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:55.826406002 CEST49784443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:55.827265978 CEST4434978413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:55.827289104 CEST4434978413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:55.827339888 CEST49784443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:55.827351093 CEST4434978413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:55.827409983 CEST49784443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:55.829082012 CEST4434978413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:55.829158068 CEST4434978413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:55.829166889 CEST49784443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:55.829175949 CEST4434978413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:55.829212904 CEST49784443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:55.920625925 CEST4434978413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:55.920655966 CEST4434978413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:55.920764923 CEST49784443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:55.920779943 CEST4434978413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:55.920823097 CEST49784443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:55.920929909 CEST4434978413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:55.920949936 CEST4434978413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:55.920984983 CEST49784443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:55.920989037 CEST4434978413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:55.921015024 CEST49784443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:55.921044111 CEST49784443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:55.921858072 CEST4434978413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:55.921875954 CEST4434978413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:55.921927929 CEST49784443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:55.921931982 CEST4434978413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:55.921972036 CEST49784443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:55.922863007 CEST4434978413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:55.922883034 CEST4434978413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:55.922961950 CEST49784443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:55.922972918 CEST4434978413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:55.923019886 CEST49784443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:55.923564911 CEST4434978413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:55.923592091 CEST4434978413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:55.923630953 CEST49784443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:55.923636913 CEST4434978413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:55.923652887 CEST49784443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:55.923667908 CEST49784443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:55.924112082 CEST4434978413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:55.924130917 CEST4434978413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:55.924170971 CEST49784443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:55.924175024 CEST4434978413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:55.924196959 CEST49784443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:55.924207926 CEST49784443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:55.924659014 CEST4434978413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:55.924716949 CEST49784443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:55.924721003 CEST4434978413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:55.924748898 CEST4434978413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:55.924757957 CEST49784443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:55.924792051 CEST49784443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:55.924829006 CEST49784443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:55.924846888 CEST4434978413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:55.924854994 CEST49784443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:55.924860954 CEST4434978413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:55.993606091 CEST49785443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:55.993709087 CEST4434978513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:55.993788958 CEST49785443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:55.994966984 CEST49786443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:55.995011091 CEST4434978613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:55.995078087 CEST49786443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:55.996875048 CEST49788443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:55.996906996 CEST49787443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:55.996927023 CEST4434978813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:55.996943951 CEST4434978713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:55.996988058 CEST49788443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:55.997015953 CEST49787443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:55.997766018 CEST49787443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:55.997778893 CEST4434978713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:55.997879028 CEST49785443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:55.997893095 CEST4434978513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:55.998794079 CEST49788443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:55.998816013 CEST4434978813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:55.998862982 CEST49786443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:55.998876095 CEST4434978613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:55.999937057 CEST49789443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:55.999983072 CEST4434978913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:56.000051022 CEST49789443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:56.000200033 CEST49789443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:56.000212908 CEST4434978913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:56.628674984 CEST4434978513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:56.629440069 CEST49785443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:56.629482985 CEST4434978513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:56.629941940 CEST49785443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:56.629951000 CEST4434978513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:56.631516933 CEST4434978713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:56.633552074 CEST49787443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:56.633569002 CEST4434978713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:56.637712002 CEST49787443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:56.637723923 CEST4434978713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:56.667136908 CEST4434978613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:56.667602062 CEST49786443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:56.667634964 CEST4434978613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:56.668023109 CEST49786443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:56.668030977 CEST4434978613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:56.687742949 CEST4434978813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:56.688529968 CEST49788443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:56.688558102 CEST4434978813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:56.689003944 CEST49788443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:56.689012051 CEST4434978813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:56.727714062 CEST4434978513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:56.727777958 CEST4434978513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:56.727827072 CEST49785443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:56.728039980 CEST49785443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:56.728065014 CEST4434978513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:56.728076935 CEST49785443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:56.728082895 CEST4434978513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:56.731420994 CEST49790443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:56.731468916 CEST4434979013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:56.731690884 CEST49790443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:56.731690884 CEST49790443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:56.731725931 CEST4434979013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:56.732697964 CEST4434978713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:56.732719898 CEST4434978713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:56.732780933 CEST49787443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:56.732799053 CEST4434978713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:56.732841969 CEST49787443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:56.732847929 CEST4434978713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:56.732889891 CEST49787443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:56.732923031 CEST49787443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:56.732938051 CEST4434978713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:56.732948065 CEST49787443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:56.732953072 CEST4434978713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:56.734831095 CEST49791443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:56.734867096 CEST4434979113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:56.734939098 CEST49791443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:56.735050917 CEST49791443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:56.735060930 CEST4434979113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:56.770143032 CEST4434978613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:56.770169020 CEST4434978613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:56.770216942 CEST49786443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:56.770246983 CEST4434978613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:56.770307064 CEST49786443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:56.770313025 CEST4434978613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:56.770324945 CEST4434978613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:56.770365953 CEST49786443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:56.770498991 CEST49786443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:56.770517111 CEST4434978613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:56.770525932 CEST49786443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:56.770530939 CEST4434978613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:56.774513960 CEST49792443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:56.774580002 CEST4434979213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:56.774662971 CEST49792443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:56.774808884 CEST49792443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:56.774840117 CEST4434979213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:56.795568943 CEST4434978813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:56.795589924 CEST4434978813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:56.795653105 CEST49788443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:56.795680046 CEST4434978813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:56.795912027 CEST49788443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:56.795912981 CEST49788443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:56.795927048 CEST4434978813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:56.796062946 CEST4434978813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:56.796089888 CEST4434978813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:56.796129942 CEST49788443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:56.798443079 CEST49793443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:56.798484087 CEST4434979313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:56.798547983 CEST49793443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:56.798674107 CEST49793443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:56.798681021 CEST4434979313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:57.119236946 CEST49794443192.168.2.44.175.87.197
                                                      Oct 7, 2024 13:23:57.119267941 CEST443497944.175.87.197192.168.2.4
                                                      Oct 7, 2024 13:23:57.119419098 CEST49794443192.168.2.44.175.87.197
                                                      Oct 7, 2024 13:23:57.119698048 CEST49794443192.168.2.44.175.87.197
                                                      Oct 7, 2024 13:23:57.119710922 CEST443497944.175.87.197192.168.2.4
                                                      Oct 7, 2024 13:23:57.380551100 CEST4434979013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:57.381684065 CEST49790443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:57.381684065 CEST49790443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:57.381716013 CEST4434979013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:57.381732941 CEST4434979013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:57.392878056 CEST4434979113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:57.393374920 CEST49791443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:57.393399954 CEST4434979113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:57.393712997 CEST49791443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:57.393718004 CEST4434979113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:57.423257113 CEST4434979213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:57.423775911 CEST49792443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:57.423791885 CEST4434979213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:57.424051046 CEST49792443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:57.424056053 CEST4434979213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:57.432988882 CEST4434979313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:57.433402061 CEST49793443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:57.433422089 CEST4434979313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:57.433912992 CEST49793443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:57.433917046 CEST4434979313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:57.450237989 CEST4434978913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:57.450545073 CEST49789443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:57.450572968 CEST4434978913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:57.451420069 CEST49789443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:57.451426029 CEST4434978913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:57.480112076 CEST4434979013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:57.480169058 CEST4434979013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:57.480314016 CEST49790443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:57.480410099 CEST49790443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:57.480410099 CEST49790443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:57.480434895 CEST4434979013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:57.480447054 CEST4434979013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:57.483175039 CEST49795443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:57.483236074 CEST4434979513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:57.483329058 CEST49795443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:57.483475924 CEST49795443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:57.483504057 CEST4434979513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:57.496695995 CEST4434979113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:57.496824980 CEST4434979113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:57.496886015 CEST49791443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:57.496939898 CEST49791443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:57.496954918 CEST4434979113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:57.496969938 CEST49791443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:57.496974945 CEST4434979113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:57.498905897 CEST49796443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:57.498936892 CEST4434979613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:57.499012947 CEST49796443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:57.499125004 CEST49796443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:57.499135017 CEST4434979613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:57.524724960 CEST4434979213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:57.524777889 CEST4434979213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:57.524832964 CEST49792443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:57.524982929 CEST49792443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:57.525000095 CEST4434979213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:57.525017023 CEST49792443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:57.525022984 CEST4434979213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:57.527240038 CEST49797443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:57.527287960 CEST4434979713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:57.527370930 CEST49797443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:57.527499914 CEST49797443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:57.527512074 CEST4434979713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:57.533873081 CEST4434979313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:57.533940077 CEST4434979313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:57.533982038 CEST49793443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:57.534102917 CEST49793443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:57.534117937 CEST4434979313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:57.534128904 CEST49793443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:57.534133911 CEST4434979313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:57.536117077 CEST49798443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:57.536137104 CEST4434979813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:57.536210060 CEST49798443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:57.536334038 CEST49798443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:57.536341906 CEST4434979813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:57.650687933 CEST4434978913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:57.650753975 CEST4434978913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:57.650896072 CEST49789443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:57.651009083 CEST49789443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:57.651009083 CEST49789443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:57.651032925 CEST4434978913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:57.651045084 CEST4434978913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:57.653589964 CEST49799443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:57.653631926 CEST4434979913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:57.653709888 CEST49799443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:57.653862953 CEST49799443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:57.653878927 CEST4434979913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:58.893843889 CEST443497944.175.87.197192.168.2.4
                                                      Oct 7, 2024 13:23:58.894015074 CEST49794443192.168.2.44.175.87.197
                                                      Oct 7, 2024 13:23:58.895677090 CEST49794443192.168.2.44.175.87.197
                                                      Oct 7, 2024 13:23:58.895704985 CEST443497944.175.87.197192.168.2.4
                                                      Oct 7, 2024 13:23:58.895962954 CEST443497944.175.87.197192.168.2.4
                                                      Oct 7, 2024 13:23:58.904695034 CEST49794443192.168.2.44.175.87.197
                                                      Oct 7, 2024 13:23:58.908998013 CEST4434979913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:58.909348965 CEST49799443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:58.909360886 CEST4434979913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:58.909730911 CEST49799443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:58.909734964 CEST4434979913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:58.912703037 CEST4434979713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:58.912976980 CEST49797443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:58.913003922 CEST4434979713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:58.913464069 CEST49797443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:58.913471937 CEST4434979713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:58.917505980 CEST4434979813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:58.917795897 CEST49798443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:58.917804003 CEST4434979813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:58.918014050 CEST4434979613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:58.918165922 CEST49798443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:58.918171883 CEST4434979813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:58.918239117 CEST49796443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:58.918246031 CEST4434979613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:58.918576956 CEST4434979513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:58.918585062 CEST49796443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:58.918589115 CEST4434979613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:58.918797970 CEST49795443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:58.918811083 CEST4434979513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:58.919117928 CEST49795443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:58.919122934 CEST4434979513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:58.947408915 CEST443497944.175.87.197192.168.2.4
                                                      Oct 7, 2024 13:23:59.019347906 CEST4434979913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:59.019458055 CEST4434979913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:59.019501925 CEST49799443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:59.019685984 CEST49799443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:59.019705057 CEST4434979913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:59.019720078 CEST49799443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:59.019730091 CEST4434979913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:59.021771908 CEST4434979613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:59.021822929 CEST4434979613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:59.021863937 CEST49796443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:59.022401094 CEST4434979813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:59.022465944 CEST4434979813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:59.022511005 CEST49798443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:59.022938967 CEST4434979513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:59.022999048 CEST4434979513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:59.023052931 CEST49795443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:59.023816109 CEST49796443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:59.023821115 CEST4434979613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:59.023834944 CEST49796443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:59.023838043 CEST49800443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:59.023838997 CEST4434979613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:59.023888111 CEST4434980013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:59.023984909 CEST49800443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:59.024018049 CEST49798443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:59.024036884 CEST4434979813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:59.025306940 CEST49800443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:59.025319099 CEST4434980013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:59.026267052 CEST49801443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:59.026304960 CEST4434980113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:59.026374102 CEST49801443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:59.026483059 CEST49801443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:59.026498079 CEST4434980113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:59.027056932 CEST49795443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:59.027070999 CEST4434979513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:59.027086020 CEST49795443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:59.027091980 CEST4434979513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:59.027416945 CEST49802443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:59.027426004 CEST4434980213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:59.027481079 CEST49802443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:59.027755022 CEST49802443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:59.027764082 CEST4434980213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:59.029032946 CEST49803443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:59.029063940 CEST4434980313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:59.029191971 CEST49803443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:59.029324055 CEST49803443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:59.029334068 CEST4434980313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:59.039359093 CEST4434979713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:59.039412975 CEST4434979713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:59.039465904 CEST49797443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:59.039531946 CEST49797443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:59.039542913 CEST4434979713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:59.039552927 CEST49797443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:59.039558887 CEST4434979713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:59.042208910 CEST49804443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:59.042223930 CEST4434980413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:59.042273998 CEST49804443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:59.042376041 CEST49804443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:59.042385101 CEST4434980413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:59.258475065 CEST443497944.175.87.197192.168.2.4
                                                      Oct 7, 2024 13:23:59.258508921 CEST443497944.175.87.197192.168.2.4
                                                      Oct 7, 2024 13:23:59.258537054 CEST443497944.175.87.197192.168.2.4
                                                      Oct 7, 2024 13:23:59.258637905 CEST49794443192.168.2.44.175.87.197
                                                      Oct 7, 2024 13:23:59.258656979 CEST443497944.175.87.197192.168.2.4
                                                      Oct 7, 2024 13:23:59.258723021 CEST49794443192.168.2.44.175.87.197
                                                      Oct 7, 2024 13:23:59.259675980 CEST443497944.175.87.197192.168.2.4
                                                      Oct 7, 2024 13:23:59.259733915 CEST443497944.175.87.197192.168.2.4
                                                      Oct 7, 2024 13:23:59.259759903 CEST443497944.175.87.197192.168.2.4
                                                      Oct 7, 2024 13:23:59.259763002 CEST49794443192.168.2.44.175.87.197
                                                      Oct 7, 2024 13:23:59.259792089 CEST49794443192.168.2.44.175.87.197
                                                      Oct 7, 2024 13:23:59.259814024 CEST49794443192.168.2.44.175.87.197
                                                      Oct 7, 2024 13:23:59.263230085 CEST49794443192.168.2.44.175.87.197
                                                      Oct 7, 2024 13:23:59.263247013 CEST443497944.175.87.197192.168.2.4
                                                      Oct 7, 2024 13:23:59.263257027 CEST49794443192.168.2.44.175.87.197
                                                      Oct 7, 2024 13:23:59.263262987 CEST443497944.175.87.197192.168.2.4
                                                      Oct 7, 2024 13:23:59.920902967 CEST4434980213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:59.920949936 CEST4434980113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:59.921389103 CEST49801443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:59.921422958 CEST4434980113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:59.921787977 CEST4434980413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:59.921824932 CEST49801443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:59.921835899 CEST4434980113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:59.921874046 CEST49802443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:59.921886921 CEST4434980213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:59.922188044 CEST49802443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:59.922194004 CEST4434980213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:59.922344923 CEST49804443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:59.922389984 CEST4434980413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:59.923094034 CEST49804443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:59.923114061 CEST4434980413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:59.924417973 CEST4434980313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:59.924822092 CEST49803443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:59.924850941 CEST4434980313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:59.925146103 CEST49803443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:59.925160885 CEST4434980313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:59.935380936 CEST4434980013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:59.935977936 CEST49800443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:59.935990095 CEST4434980013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:23:59.936431885 CEST49800443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:23:59.936436892 CEST4434980013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.019968987 CEST4434980213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.020029068 CEST4434980213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.020087957 CEST49802443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.020320892 CEST49802443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.020342112 CEST4434980213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.020358086 CEST49802443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.020366907 CEST4434980213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.022514105 CEST4434980413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.022578955 CEST4434980113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.022604942 CEST4434980413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.022633076 CEST4434980113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.022680998 CEST49804443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.022696972 CEST49801443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.022943974 CEST49801443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.022953987 CEST4434980113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.022969961 CEST49801443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.022972107 CEST49804443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.022975922 CEST4434980113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.023000002 CEST4434980413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.023020029 CEST49804443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.023027897 CEST4434980413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.025042057 CEST49805443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.025077105 CEST4434980513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.025152922 CEST49805443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.025654078 CEST49806443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.025660992 CEST4434980613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.025727987 CEST49806443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.025770903 CEST49805443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.025780916 CEST4434980513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.025847912 CEST49806443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.025856018 CEST4434980613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.026372910 CEST49807443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.026420116 CEST4434980713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.026484966 CEST49807443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.026654959 CEST49807443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.026670933 CEST4434980713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.029217005 CEST4434980313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.029262066 CEST4434980313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.029310942 CEST49803443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.029481888 CEST49803443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.029481888 CEST49803443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.029496908 CEST4434980313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.029505968 CEST4434980313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.031975031 CEST49808443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.032015085 CEST4434980813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.032082081 CEST49808443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.032241106 CEST49808443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.032255888 CEST4434980813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.038002014 CEST4434980013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.038084030 CEST4434980013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.038140059 CEST49800443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.038211107 CEST49800443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.038211107 CEST49800443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.038218021 CEST4434980013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.038223982 CEST4434980013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.040184975 CEST49809443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.040215015 CEST4434980913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.040364027 CEST49809443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.040510893 CEST49809443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.040523052 CEST4434980913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.658931971 CEST4434980613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.659445047 CEST49806443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.659461021 CEST4434980613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.659889936 CEST49806443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.659893036 CEST4434980613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.660280943 CEST4434980513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.660500050 CEST49805443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.660505056 CEST4434980513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.660816908 CEST49805443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.660820007 CEST4434980513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.661052942 CEST4434980713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.661257982 CEST49807443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.661287069 CEST4434980713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.661577940 CEST49807443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.661583900 CEST4434980713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.671327114 CEST4434980813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.671586037 CEST49808443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.671613932 CEST4434980813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.671917915 CEST49808443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.671926975 CEST4434980813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.678174973 CEST4434980913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.678469896 CEST49809443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.678495884 CEST4434980913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.678801060 CEST49809443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.678807974 CEST4434980913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.759113073 CEST4434980513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.759166956 CEST4434980513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.759251118 CEST49805443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.759450912 CEST49805443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.759465933 CEST4434980513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.759475946 CEST49805443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.759481907 CEST4434980513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.760446072 CEST4434980613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.760495901 CEST4434980713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.760497093 CEST4434980613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.760540962 CEST4434980713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.760576010 CEST49806443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.760616064 CEST49807443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.760808945 CEST49806443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.760813951 CEST4434980613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.760824919 CEST49806443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.760828018 CEST4434980613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.761779070 CEST49807443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.761801004 CEST4434980713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.761814117 CEST49807443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.761820078 CEST4434980713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.763911963 CEST49810443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.763956070 CEST4434981013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.764029980 CEST49810443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.764349937 CEST49810443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.764364958 CEST4434981013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.765117884 CEST49811443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.765158892 CEST4434981113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.765223026 CEST49811443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.765322924 CEST49811443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.765335083 CEST4434981113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.766107082 CEST49812443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.766144991 CEST4434981213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.767700911 CEST49812443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.767801046 CEST49812443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.767812967 CEST4434981213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.771370888 CEST4434980813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.771435022 CEST4434980813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.771599054 CEST49808443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.772011042 CEST49808443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.772011042 CEST49808443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.772032976 CEST4434980813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.772044897 CEST4434980813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.773891926 CEST49813443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.773914099 CEST4434981313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.774730921 CEST49813443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.774971962 CEST49813443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.774981976 CEST4434981313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.776958942 CEST4434980913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.777041912 CEST4434980913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.777103901 CEST49809443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.778847933 CEST49809443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.778856993 CEST4434980913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.778868914 CEST49809443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.778872967 CEST4434980913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.780963898 CEST49814443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.780972958 CEST4434981413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:00.781037092 CEST49814443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.781152010 CEST49814443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:00.781161070 CEST4434981413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:01.397403955 CEST4434981213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:01.398053885 CEST4434981013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:01.398087025 CEST49812443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:01.398101091 CEST4434981213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:01.398313046 CEST49810443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:01.398338079 CEST4434981013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:01.398572922 CEST49812443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:01.398577929 CEST4434981213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:01.398689032 CEST49810443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:01.398695946 CEST4434981013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:01.435942888 CEST4434981113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:01.436386108 CEST49811443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:01.436413050 CEST4434981113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:01.436780930 CEST49811443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:01.436788082 CEST4434981113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:01.439618111 CEST4434981313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:01.439903021 CEST49813443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:01.439918995 CEST4434981313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:01.440259933 CEST49813443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:01.440263987 CEST4434981313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:01.444988966 CEST4434981413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:01.445310116 CEST49814443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:01.445322990 CEST4434981413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:01.445708990 CEST49814443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:01.445713997 CEST4434981413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:01.497066021 CEST4434981213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:01.497200012 CEST4434981213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:01.497361898 CEST49812443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:01.497406960 CEST49812443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:01.497426987 CEST4434981213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:01.497437000 CEST49812443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:01.497443914 CEST4434981213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:01.497958899 CEST4434981013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:01.498018026 CEST4434981013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:01.498063087 CEST49810443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:01.498702049 CEST49810443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:01.498719931 CEST4434981013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:01.498732090 CEST49810443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:01.498737097 CEST4434981013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:01.500861883 CEST49815443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:01.500881910 CEST4434981513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:01.500948906 CEST49815443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:01.501260042 CEST49815443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:01.501271963 CEST4434981513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:01.502191067 CEST49816443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:01.502233028 CEST4434981613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:01.502289057 CEST49816443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:01.502387047 CEST49816443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:01.502403021 CEST4434981613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:01.539927006 CEST4434981113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:01.540071964 CEST4434981113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:01.540142059 CEST49811443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:01.540170908 CEST49811443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:01.540186882 CEST4434981113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:01.540198088 CEST49811443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:01.540203094 CEST4434981113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:01.542215109 CEST49817443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:01.542246103 CEST4434981713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:01.542309999 CEST49817443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:01.542424917 CEST49817443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:01.542433977 CEST4434981713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:01.543076992 CEST4434981313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:01.543154001 CEST4434981313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:01.543204069 CEST49813443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:01.543257952 CEST49813443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:01.543288946 CEST4434981313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:01.543318987 CEST49813443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:01.543334007 CEST4434981313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:01.544996977 CEST49818443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:01.545006990 CEST4434981813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:01.545068979 CEST49818443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:01.545162916 CEST49818443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:01.545170069 CEST4434981813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:01.548269987 CEST4434981413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:01.548341036 CEST4434981413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:01.548398972 CEST49814443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:01.548475981 CEST49814443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:01.548475981 CEST49814443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:01.548499107 CEST4434981413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:01.548520088 CEST4434981413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:01.550137043 CEST49819443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:01.550168991 CEST4434981913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:01.550236940 CEST49819443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:01.550339937 CEST49819443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:01.550349951 CEST4434981913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:02.150480986 CEST4434981613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:02.151045084 CEST49816443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:02.151074886 CEST4434981613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:02.151431084 CEST49816443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:02.151438951 CEST4434981613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:02.175750017 CEST4434981513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:02.176187992 CEST49815443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:02.176223040 CEST4434981513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:02.176666975 CEST49815443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:02.176672935 CEST4434981513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:02.178495884 CEST4434981713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:02.178822994 CEST49817443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:02.178899050 CEST4434981713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:02.179135084 CEST49817443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:02.179147959 CEST4434981713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:02.204574108 CEST4434981913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:02.204910994 CEST49819443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:02.204942942 CEST4434981913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:02.205327034 CEST49819443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:02.205332994 CEST4434981913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:02.219438076 CEST4434981813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:02.219777107 CEST49818443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:02.219801903 CEST4434981813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:02.219995975 CEST49818443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:02.220005035 CEST4434981813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:02.251673937 CEST4434981613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:02.251878977 CEST4434981613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:02.251976013 CEST49816443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:02.251976013 CEST49816443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:02.252058983 CEST49816443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:02.252072096 CEST4434981613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:02.254719019 CEST49820443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:02.254767895 CEST4434982013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:02.254865885 CEST49820443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:02.254951954 CEST49820443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:02.254964113 CEST4434982013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:02.288964033 CEST4434981713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:02.289127111 CEST4434981713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:02.289191008 CEST49817443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:02.289268970 CEST49817443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:02.289289951 CEST4434981713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:02.289304972 CEST49817443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:02.289309978 CEST4434981713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:02.291924953 CEST49821443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:02.291960955 CEST4434982113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:02.292061090 CEST49821443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:02.292180061 CEST49821443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:02.292191982 CEST4434982113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:02.305370092 CEST4434981913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:02.305506945 CEST4434981913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:02.305562019 CEST49819443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:02.305771112 CEST49819443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:02.305788994 CEST4434981913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:02.305799961 CEST49819443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:02.305804968 CEST4434981913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:02.308037996 CEST49822443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:02.308068037 CEST4434982213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:02.308249950 CEST49822443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:02.308249950 CEST49822443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:02.308274984 CEST4434982213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:02.319303036 CEST4434981513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:02.319370031 CEST4434981513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:02.319422007 CEST49815443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:02.320487976 CEST49815443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:02.320502996 CEST4434981513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:02.320529938 CEST49815443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:02.320534945 CEST4434981513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:02.322484016 CEST49823443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:02.322508097 CEST4434982313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:02.322561979 CEST49823443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:02.322679043 CEST49823443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:02.322688103 CEST4434982313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:02.324767113 CEST4434981813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:02.324843884 CEST4434981813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:02.324896097 CEST49818443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:02.324951887 CEST49818443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:02.324969053 CEST4434981813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:02.324980021 CEST49818443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:02.324985981 CEST4434981813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:02.326514959 CEST49824443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:02.326548100 CEST4434982413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:02.326606035 CEST49824443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:02.326961040 CEST49824443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:02.326976061 CEST4434982413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:03.300606012 CEST4434982313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:03.301131010 CEST49823443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:03.301157951 CEST4434982313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:03.301351070 CEST4434982113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:03.301575899 CEST49823443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:03.301584005 CEST4434982313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:03.302200079 CEST49821443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:03.302200079 CEST49821443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:03.302221060 CEST4434982113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:03.302232027 CEST4434982113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:03.316704988 CEST4434982013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:03.317136049 CEST49820443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:03.317150116 CEST4434982013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:03.317543983 CEST49820443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:03.317548990 CEST4434982013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:03.318036079 CEST4434982413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:03.318254948 CEST49824443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:03.318270922 CEST4434982413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:03.318557978 CEST49824443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:03.318562984 CEST4434982413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:03.321208000 CEST4434982213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:03.323694944 CEST49822443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:03.323709965 CEST4434982213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:03.327406883 CEST49822443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:03.327411890 CEST4434982213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:03.562053919 CEST4434982313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:03.562114954 CEST4434982313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:03.562206030 CEST49823443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:03.562344074 CEST4434982113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:03.562493086 CEST4434982113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:03.562689066 CEST49821443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:03.563519955 CEST4434982013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:03.563596964 CEST4434982013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:03.563638926 CEST49820443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:03.563736916 CEST4434982413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:03.563904047 CEST4434982413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:03.563950062 CEST49824443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:03.564532042 CEST4434982213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:03.564604044 CEST4434982213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:03.564811945 CEST49822443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:03.634495974 CEST49823443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:03.634495974 CEST49823443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:03.634525061 CEST4434982313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:03.634536028 CEST4434982313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:03.637959003 CEST49824443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:03.637964964 CEST4434982413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:03.638000011 CEST49824443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:03.638005972 CEST4434982413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:03.647218943 CEST49822443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:03.647253036 CEST4434982213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:03.647264957 CEST49822443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:03.647270918 CEST4434982213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:03.654887915 CEST49821443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:03.654887915 CEST49821443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:03.654896975 CEST4434982113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:03.654903889 CEST4434982113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:03.658632040 CEST49820443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:03.658652067 CEST4434982013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:03.658664942 CEST49820443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:03.658670902 CEST4434982013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:03.677393913 CEST49825443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:03.677443981 CEST4434982513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:03.677521944 CEST49825443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:03.678006887 CEST49825443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:03.678018093 CEST4434982513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:03.678977013 CEST49826443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:03.678985119 CEST4434982613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:03.679039955 CEST49826443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:03.679373980 CEST49826443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:03.679382086 CEST4434982613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:03.679958105 CEST49827443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:03.680002928 CEST4434982713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:03.680047035 CEST49827443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:03.680166006 CEST49827443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:03.680175066 CEST4434982713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:03.680517912 CEST49828443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:03.680551052 CEST4434982813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:03.680597067 CEST49828443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:03.680681944 CEST49828443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:03.680696011 CEST4434982813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:03.682528973 CEST49829443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:03.682564020 CEST4434982913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:03.682631016 CEST49829443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:03.682722092 CEST49829443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:03.682730913 CEST4434982913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:04.313395977 CEST4434982813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:04.313767910 CEST49828443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:04.313790083 CEST4434982813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:04.314341068 CEST49828443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:04.314346075 CEST4434982813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:04.316225052 CEST4434982713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:04.316549063 CEST49827443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:04.316591024 CEST4434982713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:04.316870928 CEST49827443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:04.316883087 CEST4434982713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:04.331160069 CEST4434982513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:04.331502914 CEST49825443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:04.331516027 CEST4434982513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:04.331840038 CEST49825443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:04.331844091 CEST4434982513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:04.333919048 CEST4434982913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:04.334235907 CEST49829443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:04.334258080 CEST4434982913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:04.334544897 CEST49829443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:04.334549904 CEST4434982913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:04.355405092 CEST4434982613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:04.355705023 CEST49826443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:04.355715036 CEST4434982613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:04.356087923 CEST49826443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:04.356091976 CEST4434982613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:04.416868925 CEST4434982713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:04.416949034 CEST4434982713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:04.417011023 CEST49827443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:04.417145967 CEST49827443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:04.417185068 CEST4434982713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:04.417212009 CEST49827443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:04.417227030 CEST4434982713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:04.419823885 CEST49831443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:04.419862032 CEST4434983113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:04.419950008 CEST49831443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:04.420095921 CEST49831443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:04.420109034 CEST4434983113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:04.421147108 CEST4434982813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:04.421235085 CEST4434982813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:04.421274900 CEST49828443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:04.421338081 CEST49828443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:04.421349049 CEST4434982813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:04.421359062 CEST49828443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:04.421364069 CEST4434982813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:04.423265934 CEST49832443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:04.423295975 CEST4434983213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:04.423404932 CEST49832443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:04.423527956 CEST49832443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:04.423536062 CEST4434983213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:04.429971933 CEST4434982513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:04.430042982 CEST4434982513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:04.430088043 CEST49825443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:04.430195093 CEST49825443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:04.430211067 CEST4434982513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:04.430221081 CEST49825443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:04.430227041 CEST4434982513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:04.432025909 CEST49833443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:04.432059050 CEST4434983313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:04.432136059 CEST49833443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:04.432254076 CEST49833443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:04.432267904 CEST4434983313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:04.434053898 CEST4434982913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:04.434181929 CEST4434982913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:04.434247017 CEST49829443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:04.434322119 CEST49829443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:04.434322119 CEST49829443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:04.434362888 CEST4434982913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:04.434406042 CEST4434982913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:04.436048031 CEST49834443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:04.436085939 CEST4434983413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:04.436165094 CEST49834443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:04.436265945 CEST49834443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:04.436281919 CEST4434983413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:04.461306095 CEST4434982613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:04.461360931 CEST4434982613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:04.461406946 CEST49826443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:04.461549044 CEST49826443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:04.461556911 CEST4434982613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:04.461568117 CEST49826443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:04.461572886 CEST4434982613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:04.463697910 CEST49835443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:04.463722944 CEST4434983513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:04.463803053 CEST49835443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:04.463928938 CEST49835443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:04.463937998 CEST4434983513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:05.052381039 CEST4434983113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:05.054999113 CEST49831443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:05.055026054 CEST4434983113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:05.055769920 CEST49831443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:05.055774927 CEST4434983113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:05.059556007 CEST4434983213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:05.059993982 CEST49832443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:05.060008049 CEST4434983213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:05.060404062 CEST49832443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:05.060409069 CEST4434983213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:05.100219011 CEST4434983413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:05.102154970 CEST49834443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:05.102169037 CEST4434983413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:05.102694988 CEST49834443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:05.102701902 CEST4434983413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:05.106075048 CEST4434983313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:05.106554985 CEST49833443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:05.106564999 CEST4434983313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:05.107012033 CEST49833443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:05.107018948 CEST4434983313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:05.123982906 CEST4434983513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:05.124759912 CEST49835443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:05.124783993 CEST4434983513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:05.125164986 CEST49835443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:05.125169992 CEST4434983513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:05.151670933 CEST4434983113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:05.151755095 CEST4434983113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:05.151839972 CEST49831443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:05.152045965 CEST49831443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:05.152056932 CEST4434983113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:05.152070045 CEST49831443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:05.152075052 CEST4434983113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:05.156217098 CEST49836443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:05.156255007 CEST4434983613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:05.156338930 CEST49836443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:05.156563044 CEST49836443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:05.156579018 CEST4434983613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:05.159502029 CEST4434983213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:05.159584045 CEST4434983213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:05.159642935 CEST49832443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:05.159760952 CEST49832443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:05.159770966 CEST4434983213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:05.159782887 CEST49832443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:05.159787893 CEST4434983213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:05.162549973 CEST49837443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:05.162581921 CEST4434983713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:05.162664890 CEST49837443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:05.162836075 CEST49837443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:05.162852049 CEST4434983713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:05.206537008 CEST4434983413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:05.206705093 CEST4434983413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:05.206809044 CEST49834443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:05.207086086 CEST49834443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:05.207122087 CEST4434983413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:05.207153082 CEST49834443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:05.207169056 CEST4434983413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:05.211576939 CEST49838443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:05.211618900 CEST4434983813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:05.211707115 CEST49838443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:05.211896896 CEST49838443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:05.211910963 CEST4434983813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:05.212304115 CEST4434983313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:05.212378979 CEST4434983313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:05.212430000 CEST49833443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:05.212558031 CEST49833443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:05.212575912 CEST4434983313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:05.212658882 CEST49833443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:05.212670088 CEST4434983313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:05.215157986 CEST49839443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:05.215203047 CEST4434983913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:05.215444088 CEST49839443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:05.215574980 CEST49839443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:05.215588093 CEST4434983913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:05.227628946 CEST4434983513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:05.227694035 CEST4434983513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:05.227751017 CEST49835443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:05.227940083 CEST49835443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:05.227961063 CEST4434983513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:05.227974892 CEST49835443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:05.227981091 CEST4434983513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:05.231375933 CEST49840443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:05.231424093 CEST4434984013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:05.231528997 CEST49840443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:05.231657982 CEST49840443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:05.231668949 CEST4434984013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:05.922908068 CEST4434983613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:05.923866034 CEST49836443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:05.923897982 CEST4434983613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:05.924793005 CEST49836443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:05.924798965 CEST4434983613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:06.002901077 CEST4434984013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:06.003565073 CEST49840443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:06.003597021 CEST4434984013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:06.004107952 CEST49840443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:06.004116058 CEST4434984013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:06.007921934 CEST4434983713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:06.008650064 CEST49837443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:06.008668900 CEST4434983713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:06.009197950 CEST49837443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:06.009205103 CEST4434983713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:06.017399073 CEST4434983813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:06.017730951 CEST4434983913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:06.017750025 CEST49838443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:06.017771959 CEST4434983813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:06.018418074 CEST49838443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:06.018424034 CEST4434983813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:06.018769026 CEST49839443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:06.018794060 CEST4434983913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:06.019229889 CEST49839443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:06.019238949 CEST4434983913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:06.026102066 CEST4434983613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:06.026273012 CEST4434983613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:06.026331902 CEST49836443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:06.026515007 CEST49836443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:06.026530981 CEST4434983613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:06.026541948 CEST49836443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:06.026547909 CEST4434983613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:06.031891108 CEST49841443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:06.031930923 CEST4434984113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:06.032167912 CEST49841443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:06.032380104 CEST49841443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:06.032392025 CEST4434984113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:06.102615118 CEST4434984013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:06.102708101 CEST4434984013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:06.102881908 CEST49840443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:06.109397888 CEST4434983713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:06.109468937 CEST4434983713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:06.109587908 CEST49837443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:06.121205091 CEST4434983913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:06.121289015 CEST4434983913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:06.121437073 CEST49839443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:06.121591091 CEST4434983813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:06.121665001 CEST4434983813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:06.122759104 CEST49838443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:06.189924955 CEST49840443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:06.189963102 CEST4434984013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:06.191240072 CEST49838443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:06.191261053 CEST4434983813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:06.191274881 CEST49838443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:06.191281080 CEST4434983813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:06.192322016 CEST49837443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:06.192327023 CEST4434983713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:06.192337990 CEST49837443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:06.192341089 CEST4434983713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:06.193531036 CEST49839443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:06.193561077 CEST4434983913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:06.197797060 CEST49842443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:06.197839022 CEST4434984213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:06.198090076 CEST49842443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:06.199213028 CEST49843443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:06.199248075 CEST4434984313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:06.199377060 CEST49843443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:06.199706078 CEST49842443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:06.199717045 CEST4434984213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:06.202775955 CEST49843443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:06.202788115 CEST4434984313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:06.216010094 CEST49844443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:06.216048956 CEST4434984413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:06.216216087 CEST49844443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:06.216408968 CEST49844443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:06.216422081 CEST4434984413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:06.217401028 CEST49845443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:06.217431068 CEST4434984513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:06.217483044 CEST49845443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:06.219959021 CEST49845443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:06.219969988 CEST4434984513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.019362926 CEST4434984113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.020401001 CEST49841443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.020422935 CEST4434984113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.020801067 CEST49841443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.020804882 CEST4434984113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.020951986 CEST4434984313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.021193981 CEST49843443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.021207094 CEST4434984313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.021512032 CEST49843443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.021518946 CEST4434984313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.022541046 CEST4434984513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.023296118 CEST49845443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.023319960 CEST4434984513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.023694992 CEST49845443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.023704052 CEST4434984513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.024533033 CEST4434984413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.024863005 CEST49844443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.024873972 CEST4434984413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.025193930 CEST49844443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.025197029 CEST4434984413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.025470018 CEST4434984213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.025777102 CEST49842443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.025790930 CEST4434984213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.026678085 CEST49842443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.026683092 CEST4434984213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.119028091 CEST4434984113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.119151115 CEST4434984113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.121620893 CEST4434984513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.121745110 CEST49841443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.121769905 CEST4434984513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.121773005 CEST49841443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.121788979 CEST4434984113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.121794939 CEST49841443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.121799946 CEST4434984113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.121838093 CEST49845443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.121938944 CEST49845443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.121938944 CEST49845443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.121984005 CEST4434984513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.122010946 CEST4434984513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.122843027 CEST4434984313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.122901917 CEST4434984313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.122968912 CEST49843443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.123322964 CEST49843443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.123339891 CEST4434984313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.123346090 CEST49843443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.123351097 CEST4434984313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.125452042 CEST49846443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.125482082 CEST49847443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.125500917 CEST4434984613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.125505924 CEST4434984713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.125587940 CEST49846443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.125760078 CEST49847443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.125760078 CEST49847443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.125771046 CEST49846443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.125782013 CEST4434984713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.125792027 CEST4434984613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.126311064 CEST49848443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.126344919 CEST4434984813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.127790928 CEST49848443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.127831936 CEST4434984213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.127896070 CEST4434984213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.127913952 CEST49848443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.127927065 CEST4434984813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.127948999 CEST49842443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.128017902 CEST49842443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.128031969 CEST4434984213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.128067017 CEST49842443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.128072023 CEST4434984213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.129853964 CEST49849443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.129894972 CEST4434984913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.130058050 CEST49849443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.130215883 CEST49849443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.130227089 CEST4434984913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.198576927 CEST4434984413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.198653936 CEST4434984413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.199117899 CEST49844443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.199117899 CEST49844443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.199399948 CEST49844443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.199415922 CEST4434984413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.202560902 CEST49850443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.202600002 CEST4434985013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.202709913 CEST49850443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.202861071 CEST49850443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.202871084 CEST4434985013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.226967096 CEST4972480192.168.2.4199.232.210.172
                                                      Oct 7, 2024 13:24:07.232038021 CEST8049724199.232.210.172192.168.2.4
                                                      Oct 7, 2024 13:24:07.234824896 CEST4972480192.168.2.4199.232.210.172
                                                      Oct 7, 2024 13:24:07.757056952 CEST4434984713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.758474112 CEST49847443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.758474112 CEST49847443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.758501053 CEST4434984713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.758519888 CEST4434984713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.759335041 CEST4434984613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.759814978 CEST49846443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.759850979 CEST4434984613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.760199070 CEST49846443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.760204077 CEST4434984613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.777164936 CEST4434984813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.777920008 CEST49848443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.777935982 CEST4434984813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.778419018 CEST49848443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.778424025 CEST4434984813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.810425043 CEST4434984913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.811068058 CEST49849443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.811108112 CEST4434984913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.811379910 CEST49849443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.811387062 CEST4434984913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.848932981 CEST4434985013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.849489927 CEST49850443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.849510908 CEST4434985013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.850498915 CEST49850443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.850502014 CEST4434985013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.856174946 CEST4434984713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.856262922 CEST4434984713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.856321096 CEST49847443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.856709957 CEST49847443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.856709957 CEST49847443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.856725931 CEST4434984713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.856735945 CEST4434984713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.859383106 CEST4434984613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.859477043 CEST4434984613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.859648943 CEST49846443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.859796047 CEST49846443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.859816074 CEST4434984613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.859829903 CEST49846443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.859837055 CEST4434984613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.861825943 CEST49851443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.861856937 CEST4434985113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.861927032 CEST49851443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.862076998 CEST49851443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.862090111 CEST4434985113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.862679958 CEST49852443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.862715960 CEST4434985213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.862786055 CEST49852443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.863028049 CEST49852443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.863040924 CEST4434985213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.878849030 CEST4434984813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.878933907 CEST4434984813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.878985882 CEST49848443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.879064083 CEST49848443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.879071951 CEST4434984813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.879084110 CEST49848443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.879095078 CEST4434984813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.881927013 CEST49853443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.881963015 CEST4434985313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.882030010 CEST49853443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.882204056 CEST49853443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.882215977 CEST4434985313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.915460110 CEST4434984913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.915532112 CEST4434984913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.915626049 CEST49849443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.915919065 CEST49849443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.915939093 CEST4434984913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.915950060 CEST49849443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.915956020 CEST4434984913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.919397116 CEST49854443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.919433117 CEST4434985413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.919528961 CEST49854443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.919744968 CEST49854443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.919754982 CEST4434985413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.950103998 CEST4434985013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.950184107 CEST4434985013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.950340986 CEST49850443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.950742006 CEST49850443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.950764894 CEST4434985013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.950776100 CEST49850443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.950783014 CEST4434985013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.954312086 CEST49855443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.954396963 CEST4434985513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:07.954525948 CEST49855443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.954768896 CEST49855443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:07.954799891 CEST4434985513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:08.455666065 CEST4434985313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:08.456347942 CEST49853443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:08.456361055 CEST4434985313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:08.456880093 CEST49853443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:08.456883907 CEST4434985313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:08.495127916 CEST4434985113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:08.495548010 CEST49851443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:08.495568991 CEST4434985113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:08.496105909 CEST49851443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:08.496110916 CEST4434985113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:08.524688005 CEST4434985213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:08.525258064 CEST49852443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:08.525274992 CEST4434985213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:08.525722027 CEST49852443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:08.525727987 CEST4434985213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:08.559288979 CEST4434985313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:08.559370995 CEST4434985313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:08.559442043 CEST49853443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:08.559674025 CEST49853443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:08.559690952 CEST4434985313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:08.559708118 CEST49853443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:08.559712887 CEST4434985313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:08.563147068 CEST49856443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:08.563191891 CEST4434985613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:08.563370943 CEST49856443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:08.563426018 CEST49856443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:08.563437939 CEST4434985613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:08.579164028 CEST4434985413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:08.579579115 CEST49854443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:08.579585075 CEST4434985413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:08.580056906 CEST49854443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:08.580060005 CEST4434985413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:08.594150066 CEST4434985513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:08.594180107 CEST4434985113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:08.594230890 CEST4434985113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:08.594283104 CEST49851443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:08.594424009 CEST49851443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:08.594436884 CEST4434985113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:08.594449043 CEST49851443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:08.594455004 CEST4434985113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:08.594640970 CEST49855443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:08.594702959 CEST4434985513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:08.595005989 CEST49855443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:08.595021963 CEST4434985513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:08.596971035 CEST49857443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:08.597012043 CEST4434985713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:08.597111940 CEST49857443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:08.597233057 CEST49857443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:08.597243071 CEST4434985713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:08.627330065 CEST4434985213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:08.627507925 CEST4434985213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:08.627593994 CEST49852443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:08.627640009 CEST49852443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:08.627670050 CEST4434985213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:08.627698898 CEST49852443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:08.627715111 CEST4434985213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:08.629923105 CEST49858443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:08.629940033 CEST4434985813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:08.630017042 CEST49858443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:08.630179882 CEST49858443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:08.630191088 CEST4434985813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:08.682295084 CEST4434985413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:08.682368994 CEST4434985413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:08.682456970 CEST49854443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:08.682723999 CEST49854443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:08.682742119 CEST4434985413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:08.682754040 CEST49854443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:08.682759047 CEST4434985413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:08.685925961 CEST49859443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:08.685969114 CEST4434985913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:08.686063051 CEST49859443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:08.686230898 CEST49859443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:08.686244011 CEST4434985913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:08.694644928 CEST4434985513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:08.694700003 CEST4434985513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:08.694766045 CEST49855443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:08.695871115 CEST49855443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:08.695871115 CEST49855443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:08.695904016 CEST4434985513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:08.695926905 CEST4434985513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:08.698807955 CEST49860443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:08.698856115 CEST4434986013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:08.698942900 CEST49860443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:08.699106932 CEST49860443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:08.699131966 CEST4434986013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:08.940184116 CEST49861443192.168.2.4142.250.185.68
                                                      Oct 7, 2024 13:24:08.940227985 CEST44349861142.250.185.68192.168.2.4
                                                      Oct 7, 2024 13:24:08.940304041 CEST49861443192.168.2.4142.250.185.68
                                                      Oct 7, 2024 13:24:08.940519094 CEST49861443192.168.2.4142.250.185.68
                                                      Oct 7, 2024 13:24:08.940535069 CEST44349861142.250.185.68192.168.2.4
                                                      Oct 7, 2024 13:24:09.201931953 CEST4434985613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:09.202467918 CEST49856443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:09.202500105 CEST4434985613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:09.202939034 CEST49856443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:09.202945948 CEST4434985613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:09.231323004 CEST4434985713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:09.231822968 CEST49857443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:09.231853008 CEST4434985713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:09.232321978 CEST49857443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:09.232326031 CEST4434985713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:09.289458990 CEST4434985813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:09.290010929 CEST49858443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:09.290036917 CEST4434985813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:09.290460110 CEST49858443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:09.290465117 CEST4434985813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:09.301573992 CEST4434985613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:09.301647902 CEST4434985613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:09.301714897 CEST49856443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:09.301839113 CEST49856443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:09.301860094 CEST4434985613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:09.301876068 CEST49856443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:09.301882982 CEST4434985613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:09.304830074 CEST49862443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:09.304863930 CEST4434986213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:09.304941893 CEST49862443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:09.305124044 CEST49862443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:09.305134058 CEST4434986213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:09.322628975 CEST4434985913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:09.323178053 CEST49859443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:09.323199034 CEST4434985913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:09.323668003 CEST49859443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:09.323673964 CEST4434985913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:09.330317020 CEST4434985713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:09.330374002 CEST4434985713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:09.330424070 CEST49857443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:09.330763102 CEST49857443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:09.330775976 CEST4434985713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:09.330821037 CEST49857443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:09.330826044 CEST4434985713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:09.333313942 CEST49863443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:09.333362103 CEST4434986313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:09.333446980 CEST49863443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:09.333585978 CEST49863443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:09.333599091 CEST4434986313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:09.373358965 CEST4434986013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:09.373800993 CEST49860443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:09.373830080 CEST4434986013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:09.374252081 CEST49860443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:09.374258995 CEST4434986013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:09.390701056 CEST4434985813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:09.390779018 CEST4434985813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:09.390836000 CEST49858443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:09.391011000 CEST49858443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:09.391022921 CEST4434985813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:09.391033888 CEST49858443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:09.391037941 CEST4434985813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:09.394865036 CEST49864443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:09.394901037 CEST4434986413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:09.394989967 CEST49864443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:09.395106077 CEST49864443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:09.395116091 CEST4434986413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:09.422516108 CEST4434985913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:09.422574043 CEST4434985913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:09.422858953 CEST49859443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:09.422889948 CEST49859443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:09.422904968 CEST4434985913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:09.422920942 CEST49859443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:09.422928095 CEST4434985913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:09.425620079 CEST49865443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:09.425654888 CEST4434986513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:09.425719976 CEST49865443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:09.425843000 CEST49865443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:09.425854921 CEST4434986513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:09.482335091 CEST4434986013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:09.482407093 CEST4434986013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:09.482474089 CEST49860443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:09.482614994 CEST49860443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:09.482669115 CEST4434986013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:09.482700109 CEST49860443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:09.482718945 CEST4434986013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:09.485244036 CEST49866443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:09.485275984 CEST4434986613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:09.485528946 CEST49866443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:09.485528946 CEST49866443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:09.485558033 CEST4434986613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:09.590162039 CEST44349861142.250.185.68192.168.2.4
                                                      Oct 7, 2024 13:24:09.590549946 CEST49861443192.168.2.4142.250.185.68
                                                      Oct 7, 2024 13:24:09.590567112 CEST44349861142.250.185.68192.168.2.4
                                                      Oct 7, 2024 13:24:09.590888977 CEST44349861142.250.185.68192.168.2.4
                                                      Oct 7, 2024 13:24:09.591190100 CEST49861443192.168.2.4142.250.185.68
                                                      Oct 7, 2024 13:24:09.591243029 CEST44349861142.250.185.68192.168.2.4
                                                      Oct 7, 2024 13:24:09.630984068 CEST49861443192.168.2.4142.250.185.68
                                                      Oct 7, 2024 13:24:10.263876915 CEST4434986313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:10.264440060 CEST49863443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:10.264506102 CEST4434986313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:10.264941931 CEST49863443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:10.264956951 CEST4434986313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:10.265351057 CEST4434986613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:10.265578032 CEST49866443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:10.265603065 CEST4434986613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:10.265862942 CEST49866443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:10.265867949 CEST4434986613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:10.269361973 CEST4434986413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:10.269584894 CEST49864443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:10.269646883 CEST4434986413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:10.269840002 CEST49864443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:10.269855022 CEST4434986413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:10.275850058 CEST4434986213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:10.276205063 CEST49862443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:10.276216030 CEST4434986213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:10.276510000 CEST49862443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:10.276514053 CEST4434986213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:10.283600092 CEST4434986513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:10.283870935 CEST49865443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:10.283879995 CEST4434986513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:10.284143925 CEST49865443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:10.284147978 CEST4434986513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:10.363425016 CEST4434986313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:10.363445044 CEST4434986313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:10.363579035 CEST4434986313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:10.363609076 CEST49863443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:10.363763094 CEST49863443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:10.363877058 CEST49863443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:10.363878012 CEST49863443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:10.363915920 CEST4434986313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:10.363944054 CEST4434986313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:10.366615057 CEST4434986613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:10.366630077 CEST4434986613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:10.366705894 CEST4434986613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:10.366710901 CEST49866443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:10.366755962 CEST49866443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:10.367168903 CEST49866443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:10.367168903 CEST49866443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:10.367204905 CEST4434986613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:10.367227077 CEST4434986613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:10.368510962 CEST49867443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:10.368577003 CEST4434986713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:10.368652105 CEST49867443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:10.369523048 CEST49868443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:10.369553089 CEST4434986813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:10.369612932 CEST49868443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:10.369652987 CEST4434986413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:10.369676113 CEST49867443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:10.369704008 CEST4434986713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:10.369837999 CEST4434986413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:10.369847059 CEST49868443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:10.369858980 CEST4434986813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:10.369906902 CEST49864443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:10.369950056 CEST49864443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:10.369950056 CEST49864443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:10.369975090 CEST4434986413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:10.369997025 CEST4434986413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:10.371529102 CEST49869443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:10.371618986 CEST4434986913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:10.371700048 CEST49869443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:10.371807098 CEST49869443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:10.371829987 CEST4434986913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:10.377964020 CEST4434986213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:10.378130913 CEST4434986213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:10.378187895 CEST49862443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:10.378211975 CEST49862443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:10.378212929 CEST49862443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:10.378221989 CEST4434986213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:10.378231049 CEST4434986213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:10.379728079 CEST49870443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:10.379750967 CEST4434987013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:10.379822016 CEST49870443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:10.379923105 CEST49870443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:10.379942894 CEST4434987013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:10.389149904 CEST4434986513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:10.389287949 CEST4434986513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:10.389350891 CEST49865443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:10.389513016 CEST49865443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:10.389513016 CEST49865443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:10.389528990 CEST4434986513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:10.389549017 CEST4434986513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:10.390893936 CEST49871443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:10.390909910 CEST4434987113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:10.390974045 CEST49871443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:10.391069889 CEST49871443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:10.391074896 CEST4434987113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.003808975 CEST4434986813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.004244089 CEST49868443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.004261971 CEST4434986813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.004667997 CEST49868443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.004672050 CEST4434986813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.017060041 CEST4434987013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.017394066 CEST49870443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.017419100 CEST4434987013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.017735958 CEST49870443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.017740011 CEST4434987013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.030392885 CEST4434986713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.030690908 CEST49867443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.030718088 CEST4434986713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.031023979 CEST49867443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.031030893 CEST4434986713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.036317110 CEST4434987113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.036618948 CEST49871443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.036629915 CEST4434987113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.037008047 CEST49871443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.037014008 CEST4434987113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.037291050 CEST4434986913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.037575006 CEST49869443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.037580967 CEST4434986913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.037921906 CEST49869443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.037925959 CEST4434986913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.103076935 CEST4434986813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.103106976 CEST4434986813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.103291035 CEST4434986813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.103300095 CEST49868443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.103337049 CEST49868443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.103367090 CEST49868443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.103389978 CEST4434986813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.103404999 CEST49868443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.103410959 CEST4434986813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.108639002 CEST49872443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.108671904 CEST4434987213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.108741045 CEST49872443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.108871937 CEST49872443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.108879089 CEST4434987213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.117249012 CEST4434987013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.117356062 CEST4434987013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.117500067 CEST49870443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.117758036 CEST49870443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.117779016 CEST4434987013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.117794037 CEST49870443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.117799044 CEST4434987013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.119570971 CEST49873443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.119621992 CEST4434987313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.119703054 CEST49873443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.119807005 CEST49873443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.119822025 CEST4434987313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.134998083 CEST4434987113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.135271072 CEST4434987113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.135327101 CEST49871443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.135538101 CEST49871443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.135538101 CEST49871443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.135545969 CEST4434987113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.135554075 CEST4434987113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.137079954 CEST49874443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.137093067 CEST4434987413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.137161016 CEST49874443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.137250900 CEST49874443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.137262106 CEST4434987413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.137861013 CEST4434986713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.137882948 CEST4434986713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.137927055 CEST49867443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.137945890 CEST4434986713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.137957096 CEST4434986713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.137981892 CEST49867443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.137995958 CEST49867443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.138008118 CEST4434986713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.138037920 CEST49867443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.138037920 CEST49867443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.138045073 CEST4434986713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.138051987 CEST4434986713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.139555931 CEST49875443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.139575005 CEST4434987513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.139638901 CEST49875443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.139735937 CEST49875443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.139745951 CEST4434987513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.143721104 CEST4434986913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.144061089 CEST4434986913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.144114017 CEST49869443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.144144058 CEST49869443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.144144058 CEST49869443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.144157887 CEST4434986913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.144167900 CEST4434986913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.145695925 CEST49876443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.145742893 CEST4434987613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.145812035 CEST49876443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.145911932 CEST49876443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.145925045 CEST4434987613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.747142076 CEST4434987213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.747643948 CEST49872443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.747658968 CEST4434987213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.748080969 CEST49872443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.748085022 CEST4434987213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.768568039 CEST4434987313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.769134045 CEST49873443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.769229889 CEST4434987313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.769540071 CEST49873443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.769557953 CEST4434987313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.787633896 CEST4434987513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.788072109 CEST49875443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.788083076 CEST4434987513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.788590908 CEST49875443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.788594961 CEST4434987513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.789788961 CEST4434987613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.790097952 CEST49876443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.790141106 CEST4434987613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.790488958 CEST49876443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.790494919 CEST4434987613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.796082973 CEST4434987413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.796416998 CEST49874443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.796439886 CEST4434987413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.796797991 CEST49874443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.796804905 CEST4434987413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.861890078 CEST4434987213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.861963034 CEST4434987213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.862010956 CEST49872443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.862190962 CEST49872443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.862207890 CEST4434987213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.862217903 CEST49872443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.862224102 CEST4434987213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.864845991 CEST49877443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.864891052 CEST4434987713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.864969969 CEST49877443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.865309954 CEST49877443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.865325928 CEST4434987713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.869322062 CEST4434987313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.871090889 CEST4434987313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.871176004 CEST49873443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.871268988 CEST49873443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.871268988 CEST49873443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.871316910 CEST4434987313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.871349096 CEST4434987313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.873512030 CEST49878443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.873522997 CEST4434987813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.873589039 CEST49878443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.873708010 CEST49878443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.873719931 CEST4434987813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.890047073 CEST4434987513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.890191078 CEST4434987513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.890247107 CEST49875443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.890367985 CEST49875443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.890386105 CEST4434987513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.890398979 CEST49875443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.890403986 CEST4434987513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.893039942 CEST49879443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.893083096 CEST4434987913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.893140078 CEST49879443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.893285990 CEST49879443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.893296003 CEST4434987913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.893835068 CEST4434987413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.893903971 CEST4434987413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.893961906 CEST49874443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.894043922 CEST49874443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.894045115 CEST49874443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.894089937 CEST4434987413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.894119978 CEST4434987413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.896461010 CEST49880443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.896500111 CEST4434988013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.896560907 CEST49880443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.896708965 CEST49880443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.896723032 CEST4434988013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.937035084 CEST4434987613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.937634945 CEST4434987613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.937680006 CEST49876443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.937724113 CEST49876443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.937742949 CEST4434987613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.937757969 CEST49876443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.937763929 CEST4434987613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.939881086 CEST49881443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.939917088 CEST4434988113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:11.939996958 CEST49881443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.940125942 CEST49881443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:11.940135956 CEST4434988113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:12.515762091 CEST4434987713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:12.516205072 CEST49877443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:12.516225100 CEST4434987713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:12.516670942 CEST49877443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:12.516679049 CEST4434987713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:12.519740105 CEST4434987813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:12.520001888 CEST49878443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:12.520011902 CEST4434987813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:12.520405054 CEST49878443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:12.520411015 CEST4434987813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:12.539454937 CEST4434988013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:12.539864063 CEST49880443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:12.539951086 CEST4434988013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:12.540235996 CEST4434987913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:12.540251970 CEST49880443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:12.540266037 CEST4434988013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:12.540560007 CEST49879443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:12.540633917 CEST4434987913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:12.540946007 CEST49879443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:12.540958881 CEST4434987913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:12.577918053 CEST4434988113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:12.578305006 CEST49881443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:12.578322887 CEST4434988113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:12.578747034 CEST49881443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:12.578752041 CEST4434988113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:12.622769117 CEST4434987713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:12.623481989 CEST4434987713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:12.623549938 CEST49877443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:12.623614073 CEST49877443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:12.623614073 CEST49877443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:12.623639107 CEST4434987713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:12.623652935 CEST4434987713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:12.624047995 CEST4434987813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:12.624195099 CEST4434987813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:12.624257088 CEST49878443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:12.624428034 CEST49878443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:12.624428034 CEST49878443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:12.624435902 CEST4434987813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:12.624445915 CEST4434987813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:12.626401901 CEST49882443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:12.626436949 CEST4434988213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:12.626497030 CEST49882443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:12.626838923 CEST49882443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:12.626847982 CEST4434988213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:12.627433062 CEST49883443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:12.627517939 CEST4434988313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:12.627604961 CEST49883443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:12.627697945 CEST49883443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:12.627722025 CEST4434988313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:12.642371893 CEST4434988013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:12.642872095 CEST4434988013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:12.642970085 CEST49880443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:12.643018007 CEST49880443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:12.643018007 CEST49880443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:12.643042088 CEST4434988013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:12.643064976 CEST4434988013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:12.644845009 CEST49884443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:12.644881010 CEST4434988413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:12.644951105 CEST49884443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:12.645041943 CEST49884443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:12.645056009 CEST4434988413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:12.647556067 CEST4434987913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:12.647584915 CEST4434987913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:12.647619963 CEST4434987913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:12.647627115 CEST49879443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:12.647664070 CEST49879443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:12.647821903 CEST49879443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:12.647821903 CEST49879443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:12.647836924 CEST4434987913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:12.647844076 CEST4434987913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:12.649487019 CEST49885443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:12.649578094 CEST4434988513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:12.649749041 CEST49885443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:12.649882078 CEST49885443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:12.649916887 CEST4434988513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:12.679887056 CEST4434988113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:12.679968119 CEST4434988113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:12.680089951 CEST4434988113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:12.680144072 CEST49881443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:12.680248022 CEST49881443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:12.680248022 CEST49881443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:12.680269957 CEST49881443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:12.680284977 CEST4434988113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:12.682552099 CEST49886443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:12.682568073 CEST4434988613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:12.682629108 CEST49886443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:12.682796955 CEST49886443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:12.682811022 CEST4434988613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:13.264611959 CEST4434988213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:13.265173912 CEST49882443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:13.265189886 CEST4434988213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:13.265687943 CEST49882443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:13.265692949 CEST4434988213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:13.269853115 CEST4434988313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:13.270206928 CEST49883443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:13.270272017 CEST4434988313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:13.270602942 CEST49883443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:13.270622969 CEST4434988313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:13.302010059 CEST4434988413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:13.302581072 CEST49884443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:13.302597046 CEST4434988413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:13.303059101 CEST49884443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:13.303062916 CEST4434988413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:13.311609983 CEST4434988513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:13.312107086 CEST49885443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:13.312171936 CEST4434988513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:13.312529087 CEST49885443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:13.312544107 CEST4434988513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:13.325860023 CEST4434988613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:13.328144073 CEST49886443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:13.328162909 CEST4434988613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:13.328547001 CEST49886443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:13.328557968 CEST4434988613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:13.364336014 CEST4434988213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:13.365278959 CEST4434988213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:13.365371943 CEST49882443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:13.365688086 CEST49882443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:13.365704060 CEST4434988213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:13.365736961 CEST49882443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:13.365742922 CEST4434988213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:13.369029045 CEST49887443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:13.369065046 CEST4434988713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:13.369158983 CEST49887443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:13.369277954 CEST49887443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:13.369283915 CEST4434988713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:13.369357109 CEST4434988313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:13.369549036 CEST4434988313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:13.369616985 CEST49883443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:13.369743109 CEST49883443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:13.369756937 CEST4434988313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:13.369765997 CEST49883443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:13.369771957 CEST4434988313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:13.372025967 CEST49888443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:13.372054100 CEST4434988813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:13.372126102 CEST49888443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:13.372232914 CEST49888443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:13.372243881 CEST4434988813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:13.402462006 CEST4434988413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:13.402612925 CEST4434988413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:13.402726889 CEST49884443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:13.402954102 CEST49884443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:13.402968884 CEST4434988413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:13.402978897 CEST49884443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:13.402982950 CEST4434988413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:13.405709028 CEST49889443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:13.405803919 CEST4434988913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:13.405906916 CEST49889443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:13.406039953 CEST49889443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:13.406069994 CEST4434988913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:13.414911032 CEST4434988513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:13.415061951 CEST4434988513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:13.415108919 CEST4434988513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:13.415179968 CEST49885443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:13.415249109 CEST49885443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:13.415435076 CEST49885443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:13.415435076 CEST49885443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:13.415463924 CEST4434988513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:13.415486097 CEST4434988513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:13.418200970 CEST49890443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:13.418287039 CEST4434989013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:13.418402910 CEST49890443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:13.418541908 CEST49890443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:13.418570042 CEST4434989013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:13.425045967 CEST4434988613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:13.426561117 CEST4434988613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:13.426698923 CEST49886443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:13.426978111 CEST49886443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:13.426978111 CEST49886443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:13.427016020 CEST4434988613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:13.427040100 CEST4434988613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:13.430529118 CEST49891443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:13.430557966 CEST4434989113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:13.431895018 CEST49891443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:13.432195902 CEST49891443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:13.432210922 CEST4434989113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:14.003772020 CEST4434988713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:14.004530907 CEST49887443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:14.004561901 CEST4434988713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:14.005124092 CEST49887443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:14.005131006 CEST4434988713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:14.019706011 CEST4434988813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:14.020353079 CEST49888443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:14.020378113 CEST4434988813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:14.020873070 CEST49888443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:14.020878077 CEST4434988813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:14.462219954 CEST4434988713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:14.462291956 CEST4434988713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:14.462407112 CEST49887443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:14.462830067 CEST4434988813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:14.462946892 CEST49887443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:14.462946892 CEST49887443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:14.462965965 CEST4434988713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:14.462974072 CEST4434988713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:14.462999105 CEST4434988813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:14.463049889 CEST49888443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:14.463705063 CEST49888443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:14.463720083 CEST4434988813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:14.463730097 CEST49888443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:14.463737011 CEST4434988813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:14.467086077 CEST49893443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:14.467140913 CEST4434989313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:14.467190981 CEST49892443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:14.467209101 CEST49893443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:14.467281103 CEST4434989213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:14.467341900 CEST49893443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:14.467351913 CEST49892443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:14.467356920 CEST4434989313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:14.467500925 CEST49892443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:14.467535973 CEST4434989213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:14.468218088 CEST4434988913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:14.468569040 CEST49889443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:14.468609095 CEST4434988913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:14.468621016 CEST4434989013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:14.468889952 CEST49890443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:14.468911886 CEST4434989013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:14.469038963 CEST49889443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:14.469044924 CEST4434988913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:14.469341993 CEST49890443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:14.469348907 CEST4434989013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:14.472229004 CEST4434989113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:14.472667933 CEST49891443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:14.472687960 CEST4434989113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:14.473014116 CEST49891443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:14.473021984 CEST4434989113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:14.571851015 CEST4434988913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:14.572999001 CEST4434988913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:14.573055983 CEST4434988913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:14.573075056 CEST49889443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:14.573131084 CEST49889443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:14.573235035 CEST49889443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:14.573257923 CEST4434988913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:14.573267937 CEST49889443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:14.573273897 CEST4434988913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:14.573570013 CEST4434989013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:14.573915005 CEST4434989013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:14.573982000 CEST49890443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:14.574059010 CEST49890443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:14.574063063 CEST4434989013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:14.574071884 CEST49890443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:14.574074984 CEST4434989013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:14.575539112 CEST4434989113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:14.575634956 CEST4434989113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:14.575712919 CEST49891443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:14.575731039 CEST4434989113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:14.575752020 CEST4434989113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:14.575797081 CEST49891443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:14.576229095 CEST49891443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:14.576245070 CEST4434989113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:14.576258898 CEST49891443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:14.576265097 CEST4434989113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:14.577258110 CEST49894443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:14.577307940 CEST4434989413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:14.577378035 CEST49894443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:14.578032970 CEST49895443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:14.578077078 CEST4434989513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:14.578155994 CEST49895443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:14.578226089 CEST49894443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:14.578233004 CEST49896443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:14.578249931 CEST4434989413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:14.578273058 CEST4434989613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:14.578316927 CEST49895443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:14.578331947 CEST49896443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:14.578337908 CEST4434989513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:14.578507900 CEST49896443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:14.578522921 CEST4434989613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:15.052824974 CEST4434989313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:15.053953886 CEST49893443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:15.053977966 CEST4434989313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:15.054589987 CEST49893443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:15.054594994 CEST4434989313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:15.125247002 CEST4434989213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:15.125952005 CEST49892443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:15.126020908 CEST4434989213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:15.126410007 CEST49892443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:15.126424074 CEST4434989213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:15.155461073 CEST4434989313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:15.156104088 CEST4434989313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:15.156196117 CEST49893443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:15.156286001 CEST49893443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:15.156308889 CEST4434989313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:15.156323910 CEST49893443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:15.156332016 CEST4434989313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:15.159487009 CEST49897443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:15.159529924 CEST4434989713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:15.159615993 CEST49897443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:15.159759998 CEST49897443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:15.159775972 CEST4434989713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:15.224302053 CEST4434989613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:15.225316048 CEST49896443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:15.225352049 CEST4434989613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:15.228235006 CEST4434989413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:15.229087114 CEST49896443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:15.229091883 CEST4434989613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:15.229573965 CEST49894443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:15.229607105 CEST4434989413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:15.229959965 CEST49894443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:15.229969025 CEST4434989413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:15.230221033 CEST4434989513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:15.230468988 CEST49895443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:15.230529070 CEST4434989513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:15.230822086 CEST49895443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:15.230835915 CEST4434989513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:15.323901892 CEST4434989613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:15.324196100 CEST4434989613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:15.324315071 CEST49896443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:15.324394941 CEST49896443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:15.324421883 CEST4434989613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:15.324431896 CEST49896443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:15.324438095 CEST4434989613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:15.327883005 CEST49898443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:15.327924013 CEST4434989813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:15.328003883 CEST49898443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:15.328154087 CEST49898443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:15.328165054 CEST4434989813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:15.328946114 CEST4434989413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:15.329044104 CEST4434989413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:15.329097986 CEST49894443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:15.329124928 CEST4434989413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:15.329158068 CEST4434989413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:15.329207897 CEST49894443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:15.329238892 CEST49894443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:15.329263926 CEST4434989413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:15.329276085 CEST49894443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:15.329282999 CEST4434989413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:15.331334114 CEST49899443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:15.331362963 CEST4434989913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:15.331430912 CEST49899443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:15.331551075 CEST49899443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:15.331564903 CEST4434989913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:15.340981007 CEST4434989513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:15.341095924 CEST4434989513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:15.341156960 CEST49895443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:15.341216087 CEST49895443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:15.341237068 CEST4434989513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:15.341250896 CEST49895443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:15.341258049 CEST4434989513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:15.343101978 CEST49900443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:15.343142033 CEST4434990013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:15.343210936 CEST49900443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:15.343307972 CEST49900443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:15.343319893 CEST4434990013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:15.358827114 CEST4434989213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:15.359008074 CEST4434989213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:15.359076977 CEST49892443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:15.359116077 CEST49892443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:15.359123945 CEST4434989213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:15.359137058 CEST49892443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:15.359142065 CEST4434989213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:15.361021042 CEST49901443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:15.361088037 CEST4434990113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:15.361172915 CEST49901443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:15.361282110 CEST49901443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:15.361309052 CEST4434990113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:15.798316956 CEST4434989713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:15.799102068 CEST49897443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:15.799144030 CEST4434989713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:15.799607038 CEST49897443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:15.799612999 CEST4434989713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:15.898391008 CEST4434989713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:15.898454905 CEST4434989713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:15.898545980 CEST49897443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:15.898821115 CEST49897443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:15.898838997 CEST4434989713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:15.898848057 CEST49897443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:15.898854971 CEST4434989713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:15.902348995 CEST49902443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:15.902425051 CEST4434990213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:15.902537107 CEST49902443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:15.902720928 CEST49902443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:15.902760983 CEST4434990213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:15.966784954 CEST4434989913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:15.967598915 CEST49899443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:15.967673063 CEST4434989913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:15.968028069 CEST49899443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:15.968050003 CEST4434989913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:15.977817059 CEST4434989813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:15.978452921 CEST49898443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:15.978476048 CEST4434989813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:15.979063034 CEST49898443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:15.979068041 CEST4434989813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.021478891 CEST4434990013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.022497892 CEST49900443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.022552013 CEST4434990013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.023026943 CEST49900443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.023031950 CEST4434990013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.026742935 CEST4434990113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.027165890 CEST49901443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.027228117 CEST4434990113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.027481079 CEST49901443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.027498007 CEST4434990113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.066657066 CEST4434989913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.066728115 CEST4434989913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.066838026 CEST4434989913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.066870928 CEST49899443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.066948891 CEST49899443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.067213058 CEST49899443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.067234993 CEST4434989913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.067246914 CEST49899443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.067253113 CEST4434989913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.071198940 CEST49903443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.071240902 CEST4434990313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.071321011 CEST49903443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.071474075 CEST49903443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.071490049 CEST4434990313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.080349922 CEST4434989813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.080446005 CEST4434989813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.080506086 CEST49898443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.080744028 CEST49898443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.080744028 CEST49898443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.080761909 CEST4434989813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.080773115 CEST4434989813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.083192110 CEST49904443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.083235979 CEST4434990413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.083353043 CEST49904443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.083538055 CEST49904443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.083554983 CEST4434990413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.127032042 CEST4434990013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.127124071 CEST4434990013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.127216101 CEST49900443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.127458096 CEST49900443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.127482891 CEST4434990013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.127495050 CEST49900443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.127501011 CEST4434990013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.129513025 CEST4434990113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.129744053 CEST4434990113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.129829884 CEST49901443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.129905939 CEST49901443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.129905939 CEST49901443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.129939079 CEST4434990113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.129967928 CEST4434990113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.130960941 CEST49905443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.131052017 CEST4434990513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.131145954 CEST49905443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.131340981 CEST49905443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.131378889 CEST4434990513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.132127047 CEST49906443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.132148027 CEST4434990613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.132221937 CEST49906443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.132329941 CEST49906443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.132354021 CEST4434990613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.535299063 CEST4434990213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.536000967 CEST49902443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.536067963 CEST4434990213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.536493063 CEST49902443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.536499023 CEST4434990213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.637691975 CEST4434990213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.637751102 CEST4434990213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.637842894 CEST49902443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.638129950 CEST49902443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.638145924 CEST4434990213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.638161898 CEST49902443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.638169050 CEST4434990213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.641791105 CEST49908443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.641843081 CEST4434990813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.641931057 CEST49908443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.642122984 CEST49908443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.642137051 CEST4434990813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.726056099 CEST4434990413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.726659060 CEST49904443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.726685047 CEST4434990413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.727313995 CEST49904443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.727322102 CEST4434990413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.755845070 CEST4434990313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.756323099 CEST49903443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.756345034 CEST4434990313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.757215977 CEST49903443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.757221937 CEST4434990313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.773240089 CEST4434990613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.773797035 CEST49906443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.773838043 CEST4434990613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.775736094 CEST49906443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.775744915 CEST4434990613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.793077946 CEST4434990513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.793508053 CEST49905443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.793564081 CEST4434990513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.794071913 CEST49905443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.794087887 CEST4434990513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.824457884 CEST4434990413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.824642897 CEST4434990413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.824723959 CEST49904443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.824826956 CEST49904443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.824847937 CEST4434990413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.824860096 CEST49904443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.824867010 CEST4434990413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.828066111 CEST49909443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.828111887 CEST4434990913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.828208923 CEST49909443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.828383923 CEST49909443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.828398943 CEST4434990913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.859812975 CEST4434990313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.859884977 CEST4434990313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.859951019 CEST49903443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.859970093 CEST4434990313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.860002995 CEST4434990313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.860059977 CEST49903443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.860193968 CEST49903443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.860193968 CEST49903443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.860214949 CEST4434990313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.860232115 CEST4434990313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.863605976 CEST49910443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.863651037 CEST4434991013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.863740921 CEST49910443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.863909960 CEST49910443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.863926888 CEST4434991013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.874521971 CEST4434990613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.874599934 CEST4434990613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.874677896 CEST49906443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.874825954 CEST49906443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.874849081 CEST4434990613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.874865055 CEST49906443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.874876022 CEST4434990613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.878030062 CEST49911443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.878091097 CEST4434991113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.878154993 CEST49911443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.878353119 CEST49911443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.878372908 CEST4434991113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.902904034 CEST4434990513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.903018951 CEST4434990513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.903084993 CEST49905443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.903218031 CEST49905443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.903260946 CEST4434990513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.903287888 CEST49905443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.903306961 CEST4434990513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.906737089 CEST49912443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.906815052 CEST4434991213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:16.906903982 CEST49912443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.907057047 CEST49912443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:16.907084942 CEST4434991213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:17.308705091 CEST4434990813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:17.309415102 CEST49908443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:17.309449911 CEST4434990813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:17.310020924 CEST49908443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:17.310029030 CEST4434990813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:17.376266956 CEST49913443192.168.2.4142.250.186.110
                                                      Oct 7, 2024 13:24:17.376384020 CEST44349913142.250.186.110192.168.2.4
                                                      Oct 7, 2024 13:24:17.376485109 CEST49913443192.168.2.4142.250.186.110
                                                      Oct 7, 2024 13:24:17.376758099 CEST49913443192.168.2.4142.250.186.110
                                                      Oct 7, 2024 13:24:17.376796007 CEST44349913142.250.186.110192.168.2.4
                                                      Oct 7, 2024 13:24:17.412094116 CEST4434990813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:17.412166119 CEST4434990813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:17.412211895 CEST4434990813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:17.412218094 CEST49908443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:17.412313938 CEST49908443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:17.412535906 CEST49908443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:17.412573099 CEST4434990813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:17.412600040 CEST49908443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:17.412612915 CEST4434990813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:17.416049004 CEST49914443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:17.416095972 CEST4434991413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:17.416187048 CEST49914443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:17.416426897 CEST49914443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:17.416438103 CEST4434991413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:17.478518963 CEST4434990913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:17.479043007 CEST49909443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:17.479084015 CEST4434990913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:17.479639053 CEST49909443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:17.479645967 CEST4434990913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:17.540764093 CEST4434991213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:17.541323900 CEST49912443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:17.541418076 CEST4434991213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:17.541790962 CEST49912443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:17.541807890 CEST4434991213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:17.543626070 CEST4434991113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:17.544019938 CEST49911443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:17.544055939 CEST4434991113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:17.544850111 CEST49911443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:17.544862032 CEST4434991113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:17.574825048 CEST4434991013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:17.575270891 CEST49910443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:17.575288057 CEST4434991013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:17.575809002 CEST49910443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:17.575814962 CEST4434991013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:17.577390909 CEST4434990913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:17.577542067 CEST4434990913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:17.577608109 CEST49909443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:17.577693939 CEST49909443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:17.577713013 CEST4434990913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:17.577725887 CEST49909443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:17.577732086 CEST4434990913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:17.580717087 CEST49915443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:17.580792904 CEST4434991513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:17.580888033 CEST49915443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:17.581063032 CEST49915443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:17.581084013 CEST4434991513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:17.639703035 CEST4434991213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:17.639731884 CEST4434991213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:17.639770985 CEST4434991213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:17.639832020 CEST49912443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:17.639883041 CEST49912443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:17.640104055 CEST49912443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:17.640137911 CEST4434991213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:17.640166044 CEST49912443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:17.640181065 CEST4434991213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:17.643316031 CEST49916443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:17.643346071 CEST4434991613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:17.643434048 CEST49916443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:17.643627882 CEST49916443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:17.643640041 CEST4434991613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:17.654913902 CEST4434991113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:17.656263113 CEST4434991113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:17.656337976 CEST49911443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:17.656398058 CEST49911443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:17.656398058 CEST49911443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:17.656433105 CEST4434991113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:17.656455994 CEST4434991113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:17.659148932 CEST49917443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:17.659249067 CEST4434991713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:17.659360886 CEST49917443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:17.659533978 CEST49917443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:17.659565926 CEST4434991713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:17.698194027 CEST4434991013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:17.698267937 CEST4434991013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:17.698338032 CEST49910443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:17.698360920 CEST4434991013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:17.698384047 CEST4434991013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:17.698451042 CEST49910443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:17.698621035 CEST49910443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:17.698635101 CEST4434991013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:17.698647976 CEST49910443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:17.698653936 CEST4434991013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:17.701770067 CEST49918443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:17.701865911 CEST4434991813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:17.701978922 CEST49918443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:17.702159882 CEST49918443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:17.702183962 CEST4434991813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:18.049649954 CEST44349913142.250.186.110192.168.2.4
                                                      Oct 7, 2024 13:24:18.076687098 CEST4434991413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:18.099828959 CEST49913443192.168.2.4142.250.186.110
                                                      Oct 7, 2024 13:24:18.131042004 CEST49914443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:18.218913078 CEST4434991513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:18.271800995 CEST49915443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:18.274995089 CEST49914443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:18.275007010 CEST4434991413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:18.275557995 CEST49914443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:18.275563002 CEST4434991413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:18.275815964 CEST49913443192.168.2.4142.250.186.110
                                                      Oct 7, 2024 13:24:18.275847912 CEST44349913142.250.186.110192.168.2.4
                                                      Oct 7, 2024 13:24:18.277384996 CEST44349913142.250.186.110192.168.2.4
                                                      Oct 7, 2024 13:24:18.298773050 CEST49915443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:18.298827887 CEST4434991513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:18.299241066 CEST49915443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:18.299261093 CEST4434991513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:18.303792953 CEST4434991613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:18.315439939 CEST49913443192.168.2.4142.250.186.110
                                                      Oct 7, 2024 13:24:18.315630913 CEST49913443192.168.2.4142.250.186.110
                                                      Oct 7, 2024 13:24:18.315640926 CEST44349913142.250.186.110192.168.2.4
                                                      Oct 7, 2024 13:24:18.315653086 CEST49913443192.168.2.4142.250.186.110
                                                      Oct 7, 2024 13:24:18.315680027 CEST44349913142.250.186.110192.168.2.4
                                                      Oct 7, 2024 13:24:18.316359997 CEST49916443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:18.316375971 CEST4434991613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:18.316884041 CEST49916443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:18.316889048 CEST4434991613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:18.324820995 CEST4434991713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:18.325228930 CEST49917443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:18.325292110 CEST4434991713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:18.325764894 CEST49917443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:18.325778961 CEST4434991713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:18.365421057 CEST49913443192.168.2.4142.250.186.110
                                                      Oct 7, 2024 13:24:18.375152111 CEST4434991413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:18.375427008 CEST4434991413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:18.375478029 CEST49914443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:18.375524998 CEST49914443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:18.375538111 CEST4434991413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:18.375549078 CEST49914443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:18.375554085 CEST4434991413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:18.379139900 CEST49919443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:18.379173994 CEST4434991913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:18.379240990 CEST49919443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:18.379446983 CEST49919443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:18.379457951 CEST4434991913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:18.394735098 CEST4434991513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:18.394927979 CEST4434991513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:18.394993067 CEST49915443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:18.395028114 CEST4434991513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:18.395133972 CEST49915443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:18.395154953 CEST4434991513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:18.395178080 CEST49915443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:18.395214081 CEST4434991513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:18.397933006 CEST49920443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:18.397960901 CEST4434992013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:18.398050070 CEST49920443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:18.398195028 CEST49920443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:18.398207903 CEST4434992013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:18.400290012 CEST4434991813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:18.400746107 CEST49918443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:18.400825977 CEST4434991813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:18.401382923 CEST49918443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:18.401400089 CEST4434991813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:18.411319971 CEST4434991613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:18.411537886 CEST4434991613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:18.411596060 CEST49916443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:18.411631107 CEST49916443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:18.411642075 CEST4434991613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:18.411653042 CEST49916443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:18.411659002 CEST4434991613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:18.414314985 CEST49921443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:18.414371014 CEST4434992113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:18.414475918 CEST49921443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:18.414602041 CEST49921443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:18.414628029 CEST4434992113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:18.428670883 CEST4434991713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:18.429238081 CEST4434991713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:18.429280996 CEST4434991713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:18.429307938 CEST49917443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:18.429356098 CEST49917443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:18.429408073 CEST49917443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:18.429445028 CEST4434991713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:18.429471016 CEST49917443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:18.429486036 CEST4434991713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:18.432101965 CEST49922443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:18.432138920 CEST4434992213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:18.432243109 CEST49922443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:18.432375908 CEST49922443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:18.432403088 CEST4434992213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:18.504740000 CEST4434991813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:18.504951000 CEST4434991813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:18.505045891 CEST49918443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:18.505258083 CEST49918443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:18.505284071 CEST4434991813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:18.505299091 CEST49918443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:18.505306959 CEST4434991813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:18.508563042 CEST49923443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:18.508603096 CEST4434992313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:18.508692026 CEST49923443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:18.508878946 CEST49923443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:18.508893967 CEST4434992313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:18.621171951 CEST44349913142.250.186.110192.168.2.4
                                                      Oct 7, 2024 13:24:18.621757030 CEST44349913142.250.186.110192.168.2.4
                                                      Oct 7, 2024 13:24:18.621843100 CEST49913443192.168.2.4142.250.186.110
                                                      Oct 7, 2024 13:24:18.622215986 CEST49913443192.168.2.4142.250.186.110
                                                      Oct 7, 2024 13:24:18.622236013 CEST44349913142.250.186.110192.168.2.4
                                                      Oct 7, 2024 13:24:19.039716959 CEST4434991913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.040260077 CEST49919443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.040285110 CEST4434991913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.040735960 CEST49919443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.040740967 CEST4434991913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.051639080 CEST4434992113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.052004099 CEST49921443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.052037001 CEST4434992113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.052553892 CEST49921443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.052563906 CEST4434992113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.063621998 CEST4434992213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.063977957 CEST49922443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.063987970 CEST4434992213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.064364910 CEST49922443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.064371109 CEST4434992213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.077924013 CEST4434992013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.078294039 CEST49920443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.078310966 CEST4434992013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.078835011 CEST49920443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.078839064 CEST4434992013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.142919064 CEST4434991913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.143054008 CEST4434991913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.143095016 CEST49919443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.143392086 CEST49919443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.143414021 CEST4434991913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.143424988 CEST49919443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.143430948 CEST4434991913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.146470070 CEST49924443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.146574974 CEST4434992413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.146661043 CEST49924443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.146804094 CEST49924443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.146841049 CEST4434992413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.163573027 CEST4434992213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.163644075 CEST4434992213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.163733006 CEST49922443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.164028883 CEST4434992113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.164380074 CEST4434992113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.164401054 CEST49922443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.164416075 CEST4434992113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.164422989 CEST4434992213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.164442062 CEST49921443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.164465904 CEST49921443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.164676905 CEST49921443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.164681911 CEST4434992113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.164700985 CEST49921443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.164706945 CEST4434992113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.167363882 CEST49925443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.167397022 CEST4434992513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.167598963 CEST49925443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.167706013 CEST49925443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.167722940 CEST4434992513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.167803049 CEST49926443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.167819023 CEST4434992613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.167865038 CEST49926443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.167948008 CEST49926443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.167953014 CEST4434992613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.171740055 CEST4434992313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.172096014 CEST49923443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.172110081 CEST4434992313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.172668934 CEST49923443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.172672987 CEST4434992313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.182630062 CEST4434992013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.183322906 CEST4434992013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.183389902 CEST49920443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.183418989 CEST49920443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.183433056 CEST4434992013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.183442116 CEST49920443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.183446884 CEST4434992013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.185623884 CEST49927443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.185720921 CEST4434992713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.185808897 CEST49927443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.186121941 CEST49927443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.186153889 CEST4434992713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.274451017 CEST4434992313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.274528027 CEST4434992313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.274580956 CEST49923443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.274602890 CEST4434992313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.274637938 CEST4434992313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.274684906 CEST49923443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.274785042 CEST49923443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.274796963 CEST4434992313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.274804115 CEST49923443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.274808884 CEST4434992313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.277076006 CEST49928443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.277169943 CEST4434992813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.277259111 CEST49928443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.277380943 CEST49928443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.277401924 CEST4434992813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.336718082 CEST49929443192.168.2.4142.250.186.110
                                                      Oct 7, 2024 13:24:19.336827040 CEST44349929142.250.186.110192.168.2.4
                                                      Oct 7, 2024 13:24:19.336925030 CEST49929443192.168.2.4142.250.186.110
                                                      Oct 7, 2024 13:24:19.337224960 CEST49929443192.168.2.4142.250.186.110
                                                      Oct 7, 2024 13:24:19.337260008 CEST44349929142.250.186.110192.168.2.4
                                                      Oct 7, 2024 13:24:19.493927002 CEST44349861142.250.185.68192.168.2.4
                                                      Oct 7, 2024 13:24:19.494075060 CEST44349861142.250.185.68192.168.2.4
                                                      Oct 7, 2024 13:24:19.494159937 CEST49861443192.168.2.4142.250.185.68
                                                      Oct 7, 2024 13:24:19.798342943 CEST4434992513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.798948050 CEST49925443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.798979044 CEST4434992513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.799544096 CEST49925443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.799550056 CEST4434992513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.819139004 CEST4434992413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.819533110 CEST49924443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.819576025 CEST4434992413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.820065975 CEST49924443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.820071936 CEST4434992413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.839447021 CEST4434992613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.839818001 CEST49926443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.839834929 CEST4434992613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.840341091 CEST49926443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.840346098 CEST4434992613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.874639034 CEST4434992713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.875003099 CEST49927443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.875026941 CEST4434992713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.875511885 CEST49927443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.875518084 CEST4434992713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.903737068 CEST4434992513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.904203892 CEST4434992513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.904266119 CEST49925443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.904309034 CEST49925443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.904325962 CEST4434992513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.904333115 CEST49925443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.904337883 CEST4434992513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.907109976 CEST49930443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.907149076 CEST4434993013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.907212973 CEST49930443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.907368898 CEST49930443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.907378912 CEST4434993013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.942771912 CEST4434992613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.942833900 CEST4434992613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.942878962 CEST49926443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.942985058 CEST49926443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.942995071 CEST4434992613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.943001986 CEST49926443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.943005085 CEST4434992613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.947305918 CEST49931443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.947416067 CEST4434993113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.947504044 CEST49931443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.947674036 CEST49931443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.947704077 CEST4434993113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.948117971 CEST4434992813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.948482037 CEST49928443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.948513985 CEST4434992813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.948972940 CEST49928443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.948982954 CEST4434992813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.969142914 CEST44349929142.250.186.110192.168.2.4
                                                      Oct 7, 2024 13:24:19.969438076 CEST49929443192.168.2.4142.250.186.110
                                                      Oct 7, 2024 13:24:19.969456911 CEST44349929142.250.186.110192.168.2.4
                                                      Oct 7, 2024 13:24:19.969970942 CEST44349929142.250.186.110192.168.2.4
                                                      Oct 7, 2024 13:24:19.970320940 CEST49929443192.168.2.4142.250.186.110
                                                      Oct 7, 2024 13:24:19.970402956 CEST44349929142.250.186.110192.168.2.4
                                                      Oct 7, 2024 13:24:19.970513105 CEST49929443192.168.2.4142.250.186.110
                                                      Oct 7, 2024 13:24:19.970534086 CEST49929443192.168.2.4142.250.186.110
                                                      Oct 7, 2024 13:24:19.970549107 CEST44349929142.250.186.110192.168.2.4
                                                      Oct 7, 2024 13:24:19.970937014 CEST4434992413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.971049070 CEST4434992413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.971091986 CEST49924443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.971163988 CEST49924443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.971184969 CEST4434992413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.971200943 CEST49924443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.971209049 CEST4434992413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.973555088 CEST49932443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.973597050 CEST4434993213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.973650932 CEST49932443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.973798990 CEST49932443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.973815918 CEST4434993213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.978805065 CEST4434992713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.978898048 CEST4434992713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.978943110 CEST49927443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.978954077 CEST4434992713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.979043007 CEST4434992713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.979063034 CEST49927443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.979077101 CEST49927443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.979099989 CEST49927443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.979110003 CEST4434992713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.979119062 CEST4434992713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.982168913 CEST49933443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.982198954 CEST4434993313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:19.982259035 CEST49933443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.982419014 CEST49933443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:19.982429981 CEST4434993313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:20.058667898 CEST4434992813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:20.058819056 CEST4434992813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:20.058878899 CEST49928443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:20.058931112 CEST49928443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:20.058931112 CEST49928443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:20.058959007 CEST4434992813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:20.058983088 CEST4434992813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:20.061305046 CEST49934443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:20.061321020 CEST4434993413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:20.061371088 CEST49934443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:20.061530113 CEST49934443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:20.061542988 CEST4434993413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:20.266717911 CEST44349929142.250.186.110192.168.2.4
                                                      Oct 7, 2024 13:24:20.267308950 CEST44349929142.250.186.110192.168.2.4
                                                      Oct 7, 2024 13:24:20.267399073 CEST49929443192.168.2.4142.250.186.110
                                                      Oct 7, 2024 13:24:20.267714977 CEST49929443192.168.2.4142.250.186.110
                                                      Oct 7, 2024 13:24:20.267777920 CEST44349929142.250.186.110192.168.2.4
                                                      Oct 7, 2024 13:24:20.542077065 CEST4434993013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:20.542556047 CEST49930443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:20.542577028 CEST4434993013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:20.542958975 CEST49930443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:20.542964935 CEST4434993013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:20.582581043 CEST4434993113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:20.583113909 CEST49931443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:20.583195925 CEST4434993113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:20.583437920 CEST49931443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:20.583453894 CEST4434993113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:20.613094091 CEST4434993213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:20.616719007 CEST49932443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:20.616760015 CEST4434993213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:20.617330074 CEST49932443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:20.617337942 CEST4434993213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:20.631094933 CEST4434993313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:20.631411076 CEST49933443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:20.631452084 CEST4434993313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:20.632205963 CEST49933443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:20.632215977 CEST4434993313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:20.642225027 CEST4434993013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:20.642255068 CEST4434993013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:20.642303944 CEST4434993013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:20.642314911 CEST49930443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:20.642358065 CEST49930443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:20.642529964 CEST49930443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:20.642543077 CEST4434993013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:20.642553091 CEST49930443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:20.642556906 CEST4434993013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:20.644908905 CEST49935443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:20.644948959 CEST4434993513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:20.645035028 CEST49935443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:20.645167112 CEST49935443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:20.645174980 CEST4434993513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:20.682523012 CEST4434993113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:20.683140993 CEST4434993113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:20.683228016 CEST49931443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:20.683341026 CEST49931443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:20.683378935 CEST4434993113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:20.683428049 CEST49931443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:20.683444023 CEST4434993113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:20.685319901 CEST49936443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:20.685352087 CEST4434993613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:20.685528994 CEST49936443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:20.685668945 CEST49936443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:20.685676098 CEST4434993613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:20.712184906 CEST4434993213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:20.712241888 CEST4434993213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:20.712349892 CEST49932443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:20.712574005 CEST49932443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:20.712589025 CEST4434993213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:20.712600946 CEST49932443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:20.712606907 CEST4434993213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:20.715044975 CEST49937443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:20.715138912 CEST4434993713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:20.715229988 CEST49937443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:20.715356112 CEST49937443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:20.715394020 CEST4434993713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:20.731847048 CEST4434993313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:20.732074976 CEST4434993313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:20.732132912 CEST49933443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:20.732316971 CEST49933443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:20.732341051 CEST4434993313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:20.732355118 CEST49933443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:20.732362986 CEST4434993313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:20.734379053 CEST49938443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:20.734401941 CEST4434993813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:20.734483957 CEST49938443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:20.734575033 CEST49938443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:20.734596968 CEST4434993813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:20.751429081 CEST4434993413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:20.751784086 CEST49934443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:20.751827002 CEST4434993413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:20.752212048 CEST49934443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:20.752219915 CEST4434993413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:20.859124899 CEST4434993413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:20.859277010 CEST4434993413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:20.859428883 CEST49934443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:20.859525919 CEST49934443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:20.859555006 CEST4434993413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:20.859574080 CEST49934443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:20.859582901 CEST4434993413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:20.862202883 CEST49939443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:20.862226963 CEST4434993913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:20.862287998 CEST49939443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:20.862458944 CEST49939443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:20.862468958 CEST4434993913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:21.325817108 CEST4434993513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:21.326458931 CEST49935443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:21.326494932 CEST4434993513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:21.326559067 CEST4434993613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:21.326858044 CEST49935443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:21.326865911 CEST4434993513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:21.327040911 CEST49936443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:21.327069998 CEST4434993613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:21.327322960 CEST49936443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:21.327327967 CEST4434993613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:21.393572092 CEST4434993713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:21.394284010 CEST49937443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:21.394371986 CEST4434993713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:21.394778967 CEST49937443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:21.394794941 CEST4434993713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:21.395237923 CEST4434993813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:21.395536900 CEST49938443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:21.395576954 CEST4434993813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:21.395884991 CEST49938443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:21.395896912 CEST4434993813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:21.428198099 CEST4434993613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:21.428586006 CEST4434993613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:21.428646088 CEST49936443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:21.428723097 CEST49936443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:21.428740978 CEST4434993613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:21.428749084 CEST49936443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:21.428755045 CEST4434993613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:21.431051016 CEST4434993513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:21.431298971 CEST4434993513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:21.431360960 CEST49935443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:21.432868004 CEST49935443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:21.432885885 CEST4434993513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:21.432900906 CEST49935443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:21.432909012 CEST4434993513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:21.435630083 CEST49940443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:21.435708046 CEST4434994013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:21.435781002 CEST49940443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:21.435925961 CEST49940443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:21.435960054 CEST4434994013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:21.436140060 CEST49941443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:21.436177015 CEST4434994113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:21.436235905 CEST49941443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:21.436486006 CEST49941443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:21.436501026 CEST4434994113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:21.496345043 CEST4434993813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:21.496443987 CEST4434993813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:21.496510029 CEST49938443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:21.496571064 CEST4434993813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:21.496606112 CEST4434993813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:21.496663094 CEST49938443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:21.496846914 CEST49938443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:21.496886015 CEST4434993813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:21.496915102 CEST49938443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:21.496927977 CEST4434993813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:21.498797894 CEST4434993713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:21.498867035 CEST4434993713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:21.498929977 CEST49937443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:21.499717951 CEST49942443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:21.499752998 CEST4434994213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:21.499814034 CEST49942443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:21.499893904 CEST49937443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:21.499912024 CEST4434993713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:21.499929905 CEST49937443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:21.499938965 CEST4434993713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:21.500886917 CEST49942443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:21.500902891 CEST4434994213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:21.501910925 CEST49943443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:21.501983881 CEST4434994313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:21.502060890 CEST49943443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:21.502161026 CEST49943443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:21.502192974 CEST4434994313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:21.510446072 CEST4434993913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:21.514089108 CEST49939443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:21.514101028 CEST4434993913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:21.514549017 CEST49939443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:21.514553070 CEST4434993913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:21.610892057 CEST4434993913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:21.611043930 CEST4434993913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:21.611114025 CEST49939443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:21.611366034 CEST49939443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:21.611366034 CEST49939443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:21.611392021 CEST4434993913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:21.611404896 CEST4434993913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:21.614523888 CEST49944443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:21.614603996 CEST4434994413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:21.614706039 CEST49944443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:21.614873886 CEST49944443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:21.614911079 CEST4434994413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.070924044 CEST4434994013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.071624994 CEST49940443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:22.071687937 CEST4434994013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.072290897 CEST49940443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:22.072307110 CEST4434994013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.102705956 CEST4434994113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.103156090 CEST49941443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:22.103174925 CEST4434994113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.103642941 CEST49941443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:22.103648901 CEST4434994113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.139254093 CEST4434994313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.139735937 CEST49943443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:22.139777899 CEST4434994313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.140178919 CEST49943443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:22.140189886 CEST4434994313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.170206070 CEST4434994013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.170268059 CEST4434994013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.170329094 CEST49940443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:22.170603037 CEST49940443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:22.170634985 CEST4434994013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.170660019 CEST49940443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:22.170675993 CEST4434994013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.173465014 CEST49945443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:22.173542976 CEST4434994513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.173620939 CEST49945443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:22.173755884 CEST49945443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:22.173774958 CEST4434994513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.180010080 CEST4434994213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.180357933 CEST49942443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:22.180377960 CEST4434994213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.180813074 CEST49942443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:22.180818081 CEST4434994213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.205238104 CEST4434994113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.205362082 CEST4434994113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.205421925 CEST49941443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:22.205631018 CEST49941443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:22.205647945 CEST4434994113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.205657959 CEST49941443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:22.205662966 CEST4434994113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.212007999 CEST49946443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:22.212074041 CEST4434994613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.212152958 CEST49946443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:22.212595940 CEST49946443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:22.212618113 CEST4434994613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.251837015 CEST4434994313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.251863956 CEST4434994313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.251918077 CEST4434994313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.252042055 CEST49943443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:22.252042055 CEST49943443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:22.252202034 CEST49943443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:22.252249956 CEST4434994313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.252283096 CEST49943443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:22.252300978 CEST4434994313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.255084038 CEST49947443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:22.255172014 CEST4434994713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.255253077 CEST49947443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:22.255373001 CEST49947443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:22.255409002 CEST4434994713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.259933949 CEST4434994413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.260334015 CEST49944443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:22.260370016 CEST4434994413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.260797024 CEST49944443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:22.260807991 CEST4434994413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.298357010 CEST4434994213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.298410892 CEST4434994213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.298465967 CEST49942443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:22.298479080 CEST4434994213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.298533916 CEST4434994213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.298579931 CEST49942443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:22.298676014 CEST49942443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:22.298686981 CEST4434994213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.298712015 CEST49942443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:22.298717022 CEST4434994213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.301551104 CEST49948443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:22.301589012 CEST4434994813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.301657915 CEST49948443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:22.301789045 CEST49948443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:22.301798105 CEST4434994813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.359729052 CEST4434994413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.359817028 CEST4434994413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.359922886 CEST4434994413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.360018015 CEST49944443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:22.360224009 CEST49944443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:22.360275984 CEST4434994413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.360306978 CEST49944443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:22.360323906 CEST4434994413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.363775015 CEST49949443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:22.363862991 CEST4434994913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.363976002 CEST49949443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:22.364152908 CEST49949443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:22.364186049 CEST4434994913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.808758974 CEST4434994513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.827564955 CEST49945443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:22.827615976 CEST4434994513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.828042984 CEST49945443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:22.828057051 CEST4434994513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.851103067 CEST4434994613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.855467081 CEST49946443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:22.855509043 CEST4434994613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.855947971 CEST49946443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:22.855963945 CEST4434994613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.923060894 CEST4434994513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.923201084 CEST4434994513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.924010992 CEST49945443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:22.926660061 CEST49945443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:22.926698923 CEST4434994513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.926727057 CEST49945443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:22.926742077 CEST4434994513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.929131985 CEST4434994713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.930630922 CEST49947443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:22.930674076 CEST4434994713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.931102037 CEST49947443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:22.931116104 CEST4434994713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.935902119 CEST49950443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:22.935995102 CEST4434995013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.936089993 CEST49950443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:22.936240911 CEST49950443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:22.936275005 CEST4434995013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.944160938 CEST4434994813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.948380947 CEST49948443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:22.948402882 CEST4434994813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.948821068 CEST49948443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:22.948831081 CEST4434994813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.950134039 CEST4434994613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.950191021 CEST4434994613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.950256109 CEST49946443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:22.950278997 CEST4434994613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.950349092 CEST4434994613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.950416088 CEST49946443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:22.950445890 CEST4434994613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.950469971 CEST49946443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:22.950483084 CEST4434994613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.953891993 CEST49951443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:22.953931093 CEST4434995113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:22.954015017 CEST49951443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:22.954839945 CEST49951443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:22.954852104 CEST4434995113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:23.004221916 CEST4434994913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:23.004702091 CEST49949443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:23.004762888 CEST4434994913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:23.005162954 CEST49949443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:23.005176067 CEST4434994913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:23.033932924 CEST4434994713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:23.034086943 CEST4434994713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:23.034425020 CEST49947443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:23.034558058 CEST49947443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:23.034600019 CEST4434994713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:23.034626961 CEST49947443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:23.034641027 CEST4434994713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:23.040186882 CEST49952443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:23.040226936 CEST4434995213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:23.040293932 CEST49952443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:23.040476084 CEST49952443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:23.040489912 CEST4434995213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:23.044224024 CEST4434994813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:23.044262886 CEST4434994813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:23.044322014 CEST49948443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:23.044334888 CEST4434994813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:23.044478893 CEST4434994813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:23.044563055 CEST49948443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:23.044580936 CEST4434994813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:23.044593096 CEST49948443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:23.044598103 CEST4434994813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:23.044641018 CEST49948443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:23.044645071 CEST4434994813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:23.047209978 CEST49953443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:23.047291994 CEST4434995313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:23.047350883 CEST49953443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:23.047492981 CEST49953443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:23.047504902 CEST4434995313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:23.104221106 CEST4434994913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:23.104253054 CEST4434994913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:23.104304075 CEST4434994913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:23.104315042 CEST49949443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:23.104377985 CEST49949443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:23.104538918 CEST49949443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:23.104538918 CEST49949443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:23.104582071 CEST4434994913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:23.104609966 CEST4434994913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:23.107462883 CEST49954443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:23.107512951 CEST4434995413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:23.107584000 CEST49954443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:23.107750893 CEST49954443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:23.107774973 CEST4434995413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:23.569938898 CEST4434995013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:23.570564032 CEST49950443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:23.570647955 CEST4434995013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:23.571032047 CEST49950443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:23.571048021 CEST4434995013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:23.633207083 CEST4434995113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:23.633892059 CEST49951443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:23.633935928 CEST4434995113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:23.634414911 CEST49951443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:23.634421110 CEST4434995113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:23.669110060 CEST4434995013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:23.669177055 CEST4434995013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:23.669224024 CEST4434995013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:23.669262886 CEST49950443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:23.669347048 CEST49950443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:23.669543982 CEST49950443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:23.669589996 CEST4434995013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:23.669620991 CEST49950443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:23.669639111 CEST4434995013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:23.672903061 CEST49955443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:23.672935009 CEST4434995513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:23.673022032 CEST49955443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:23.673177958 CEST49955443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:23.673191071 CEST4434995513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:23.688807964 CEST4434995313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:23.689229965 CEST49953443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:23.689270020 CEST4434995313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:23.689681053 CEST49953443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:23.689692020 CEST4434995313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:23.705333948 CEST4434995213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:23.705723047 CEST49952443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:23.705740929 CEST4434995213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:23.706043005 CEST49952443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:23.706047058 CEST4434995213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:23.737942934 CEST4434995113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:23.738032103 CEST4434995113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:23.738116026 CEST49951443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:23.738459110 CEST49951443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:23.738487959 CEST4434995113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:23.738498926 CEST49951443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:23.738504887 CEST4434995113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:23.742443085 CEST49956443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:23.742552042 CEST4434995613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:23.742851019 CEST49956443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:23.742851019 CEST49956443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:23.742945910 CEST4434995613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:23.774182081 CEST4434995413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:23.774947882 CEST49954443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:23.775005102 CEST4434995413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:23.778356075 CEST49954443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:23.778367996 CEST4434995413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:23.789273977 CEST4434995313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:23.789371967 CEST4434995313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:23.789464951 CEST49953443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:23.789577007 CEST49953443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:23.789608955 CEST4434995313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:23.789634943 CEST49953443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:23.789649963 CEST4434995313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:23.792723894 CEST49957443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:23.792773962 CEST4434995713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:23.792869091 CEST49957443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:23.793013096 CEST49957443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:23.793029070 CEST4434995713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:24.850061893 CEST4434995213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:24.850140095 CEST4434995213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:24.850229025 CEST49952443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:24.850517988 CEST49952443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:24.850521088 CEST4434995413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:24.850554943 CEST4434995413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:24.850559950 CEST4434995213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:24.850573063 CEST49952443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:24.850579977 CEST4434995213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:24.850610018 CEST4434995413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:24.850605011 CEST49954443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:24.850667000 CEST49954443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:24.851511002 CEST49954443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:24.851563931 CEST4434995413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:24.851594925 CEST49954443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:24.851614952 CEST4434995413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:24.855410099 CEST49958443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:24.855451107 CEST4434995813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:24.855524063 CEST49958443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:24.855941057 CEST49958443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:24.855952024 CEST4434995813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:24.856688976 CEST49959443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:24.856786013 CEST4434995913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:24.856875896 CEST49959443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:24.857002020 CEST49959443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:24.857037067 CEST4434995913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:25.038398027 CEST4434995613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:25.038537979 CEST4434995513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:25.042999029 CEST4434995713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:25.055664062 CEST49956443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:25.055715084 CEST4434995613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:25.056102037 CEST49956443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:25.056113958 CEST4434995613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:25.056293964 CEST49955443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:25.056314945 CEST4434995513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:25.056607962 CEST49955443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:25.056612015 CEST4434995513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:25.056889057 CEST49957443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:25.056905985 CEST4434995713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:25.057195902 CEST49957443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:25.057200909 CEST4434995713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:25.151680946 CEST4434995613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:25.151756048 CEST4434995613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:25.151861906 CEST4434995613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:25.151881933 CEST49956443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:25.151954889 CEST49956443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:25.244330883 CEST49956443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:25.244380951 CEST4434995613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:25.244607925 CEST49956443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:25.244626045 CEST4434995613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:25.246665001 CEST4434995513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:25.246764898 CEST4434995513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:25.246823072 CEST49955443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:25.324616909 CEST49955443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:25.324650049 CEST4434995513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:25.324661016 CEST49955443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:25.324667931 CEST4434995513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:25.341545105 CEST49961443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:25.341593027 CEST4434996113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:25.341666937 CEST49960443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:25.341691017 CEST49961443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:25.341773987 CEST4434996013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:25.341855049 CEST49960443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:25.341960907 CEST49961443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:25.341979980 CEST4434996113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:25.342040062 CEST49960443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:25.342072964 CEST4434996013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:25.496562958 CEST4434995913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:25.497114897 CEST49959443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:25.497165918 CEST4434995913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:25.497606993 CEST49959443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:25.497620106 CEST4434995913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:25.507282019 CEST4434995813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:25.507833958 CEST49958443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:25.507863045 CEST4434995813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:25.508373976 CEST49958443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:25.508383036 CEST4434995813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:25.596523046 CEST4434995913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:25.597400904 CEST4434995913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:25.597482920 CEST49959443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:25.597539902 CEST49959443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:25.597539902 CEST49959443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:25.597573996 CEST4434995913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:25.597601891 CEST4434995913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:25.600477934 CEST49962443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:25.600512028 CEST4434996213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:25.600585938 CEST49962443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:25.600737095 CEST49962443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:25.600747108 CEST4434996213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:25.607533932 CEST4434995813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:25.607620955 CEST4434995813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:25.607682943 CEST49958443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:25.607712030 CEST4434995813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:25.607738972 CEST4434995813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:25.607789040 CEST49958443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:25.607847929 CEST49958443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:25.607862949 CEST4434995813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:25.607871056 CEST49958443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:25.607876062 CEST4434995813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:25.610253096 CEST49963443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:25.610358000 CEST4434996313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:25.610449076 CEST49963443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:25.610611916 CEST49963443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:25.610652924 CEST4434996313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:25.676280022 CEST4434995713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:25.676389933 CEST4434995713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:25.676460981 CEST49957443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:25.676615953 CEST49957443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:25.676635981 CEST4434995713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:25.676649094 CEST49957443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:25.676655054 CEST4434995713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:25.680393934 CEST49964443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:25.680434942 CEST4434996413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:25.680499077 CEST49964443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:25.680660963 CEST49964443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:25.680674076 CEST4434996413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:25.988765955 CEST4434996013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:25.989439964 CEST49960443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:25.989521027 CEST4434996013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:25.989787102 CEST49960443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:25.989804029 CEST4434996013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.008399963 CEST4434996113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.008800983 CEST49961443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:26.008821964 CEST4434996113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.009196997 CEST49961443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:26.009202957 CEST4434996113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.095053911 CEST4434996013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.095202923 CEST4434996013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.095273018 CEST49960443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:26.095447063 CEST49960443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:26.095472097 CEST4434996013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.095487118 CEST49960443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:26.095494032 CEST4434996013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.099036932 CEST49965443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:26.099101067 CEST4434996513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.099205971 CEST49965443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:26.099395990 CEST49965443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:26.099415064 CEST4434996513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.153080940 CEST4434996113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.153166056 CEST4434996113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.153239012 CEST49961443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:26.153472900 CEST49961443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:26.153493881 CEST4434996113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.153506041 CEST49961443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:26.153512001 CEST4434996113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.156677008 CEST49966443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:26.156790018 CEST4434996613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.156898975 CEST49966443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:26.157032967 CEST49966443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:26.157063961 CEST4434996613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.233942986 CEST4434996213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.234781981 CEST49962443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:26.234801054 CEST4434996213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.235198975 CEST49962443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:26.235203981 CEST4434996213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.298753977 CEST4434996313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.299530983 CEST49963443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:26.299612999 CEST4434996313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.300019979 CEST49963443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:26.300035954 CEST4434996313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.321429968 CEST4434996413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.324661016 CEST49964443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:26.324682951 CEST4434996413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.325212002 CEST49964443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:26.325216055 CEST4434996413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.333703995 CEST4434996213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.333837032 CEST4434996213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.333911896 CEST49962443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:26.333986044 CEST49962443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:26.334000111 CEST4434996213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.334011078 CEST49962443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:26.334016085 CEST4434996213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.340310097 CEST49967443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:26.340357065 CEST4434996713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.340445042 CEST49967443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:26.340581894 CEST49967443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:26.340594053 CEST4434996713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.404362917 CEST4434996313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.404472113 CEST4434996313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.404598951 CEST49963443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:26.404756069 CEST49963443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:26.404757023 CEST49963443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:26.404804945 CEST4434996313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.404834986 CEST4434996313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.408211946 CEST49968443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:26.408267021 CEST4434996813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.408355951 CEST49968443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:26.408605099 CEST49968443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:26.408620119 CEST4434996813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.420819044 CEST4434996413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.421044111 CEST4434996413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.421116114 CEST49964443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:26.421134949 CEST4434996413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.421165943 CEST4434996413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.421231031 CEST49964443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:26.421256065 CEST49964443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:26.421264887 CEST4434996413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.421278954 CEST49964443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:26.421283007 CEST4434996413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.424551010 CEST49969443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:26.424660921 CEST4434996913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.424765110 CEST49969443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:26.424947023 CEST49969443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:26.424983978 CEST4434996913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.741254091 CEST4434996513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.742247105 CEST49965443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:26.742311954 CEST4434996513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.743201017 CEST49965443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:26.743215084 CEST4434996513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.788579941 CEST4434996613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.789535999 CEST49966443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:26.789629936 CEST4434996613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.789961100 CEST49966443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:26.789978027 CEST4434996613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.840687037 CEST4434996513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.840766907 CEST4434996513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.840852976 CEST49965443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:26.841032982 CEST49965443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:26.841085911 CEST4434996513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.841116905 CEST49965443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:26.841134071 CEST4434996513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.844171047 CEST49970443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:26.844279051 CEST4434997013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.844386101 CEST49970443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:26.844552040 CEST49970443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:26.844583988 CEST4434997013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.887367964 CEST4434996613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.887464046 CEST4434996613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.887512922 CEST4434996613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.887670040 CEST49966443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:26.887670994 CEST49966443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:26.887770891 CEST49966443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:26.887770891 CEST49966443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:26.887814045 CEST4434996613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.887847900 CEST4434996613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.890376091 CEST49971443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:26.890417099 CEST4434997113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.890500069 CEST49971443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:26.890645981 CEST49971443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:26.890661001 CEST4434997113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.976183891 CEST4434996713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.980452061 CEST49967443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:26.980540037 CEST4434996713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:26.981035948 CEST49967443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:26.981040955 CEST4434996713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.077208996 CEST4434996713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.077281952 CEST4434996713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.077356100 CEST49967443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:27.077526093 CEST49967443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:27.077543020 CEST4434996713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.077554941 CEST49967443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:27.077559948 CEST4434996713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.079056025 CEST4434996913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.079478025 CEST49969443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:27.079549074 CEST4434996913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.080190897 CEST49969443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:27.080205917 CEST4434996913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.082062960 CEST49972443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:27.082118034 CEST4434997213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.082186937 CEST49972443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:27.082580090 CEST49972443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:27.082598925 CEST4434997213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.086832047 CEST4434996813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.090965033 CEST49968443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:27.091042995 CEST4434996813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.093713045 CEST49968443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:27.093719959 CEST4434996813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.180495977 CEST4434996913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.180660963 CEST4434996913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.180727005 CEST49969443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:27.180797100 CEST49969443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:27.180810928 CEST4434996913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.180819988 CEST49969443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:27.180824995 CEST4434996913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.183773041 CEST49973443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:27.183805943 CEST4434997313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.183881998 CEST49973443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:27.184092045 CEST49973443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:27.184106112 CEST4434997313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.203310966 CEST4434996813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.203340054 CEST4434996813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.203398943 CEST4434996813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.203402042 CEST49968443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:27.203448057 CEST49968443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:27.203666925 CEST49968443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:27.203685045 CEST4434996813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.203697920 CEST49968443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:27.203705072 CEST4434996813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.206337929 CEST49974443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:27.206348896 CEST4434997413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.206435919 CEST49974443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:27.206568003 CEST49974443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:27.206581116 CEST4434997413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.479626894 CEST4434997013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.482656956 CEST49970443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:27.482686043 CEST4434997013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.483273983 CEST49970443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:27.483278990 CEST4434997013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.539303064 CEST4434997113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.549314976 CEST49971443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:27.549356937 CEST4434997113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.549906015 CEST49971443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:27.549913883 CEST4434997113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.578579903 CEST4434997013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.578635931 CEST4434997013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.578694105 CEST4434997013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.578720093 CEST49970443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:27.578784943 CEST49970443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:27.601870060 CEST49970443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:27.601913929 CEST4434997013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.601959944 CEST49970443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:27.601975918 CEST4434997013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.606111050 CEST49975443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:27.606165886 CEST4434997513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.606437922 CEST49975443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:27.606673002 CEST49975443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:27.606714010 CEST4434997513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.646827936 CEST4434997113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.646920919 CEST4434997113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.647082090 CEST49971443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:27.659307957 CEST49971443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:27.659333944 CEST4434997113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.659351110 CEST49971443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:27.659359932 CEST4434997113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.670500994 CEST49976443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:27.670599937 CEST4434997613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.670703888 CEST49976443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:27.671427965 CEST49976443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:27.671466112 CEST4434997613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.729916096 CEST4434997213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.766868114 CEST49972443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:27.766952991 CEST4434997213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.767431974 CEST49972443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:27.767448902 CEST4434997213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.840576887 CEST4434997413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.847223997 CEST49974443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:27.847237110 CEST4434997413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.847827911 CEST49974443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:27.847835064 CEST4434997413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.857954025 CEST4434997313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.861824036 CEST49973443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:27.861850023 CEST4434997313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.866545916 CEST49973443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:27.866554976 CEST4434997313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.870261908 CEST4434997213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.870289087 CEST4434997213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.870357990 CEST4434997213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.870378971 CEST49972443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:27.870454073 CEST49972443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:27.871591091 CEST49972443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:27.871634007 CEST4434997213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.871668100 CEST49972443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:27.871685982 CEST4434997213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.913573980 CEST49977443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:27.913613081 CEST4434997713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.913707972 CEST49977443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:27.941762924 CEST49977443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:27.941786051 CEST4434997713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.943223000 CEST4434997413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.943710089 CEST4434997413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.943751097 CEST4434997413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.943773985 CEST49974443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:27.943821907 CEST49974443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:27.943854094 CEST49974443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:27.943873882 CEST4434997413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.943886042 CEST49974443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:27.943892002 CEST4434997413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.946855068 CEST49978443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:27.946892977 CEST4434997813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.946963072 CEST49978443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:27.947104931 CEST49978443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:27.947118044 CEST4434997813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.965399027 CEST4434997313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.965456963 CEST4434997313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.965528965 CEST49973443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:27.965540886 CEST4434997313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.965881109 CEST4434997313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.965944052 CEST49973443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:27.990294933 CEST49973443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:27.990323067 CEST4434997313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:27.990345001 CEST49973443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:27.990350962 CEST4434997313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:28.005491018 CEST49979443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:28.005542994 CEST4434997913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:28.005625963 CEST49979443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:28.010760069 CEST49979443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:28.010797977 CEST4434997913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:28.246392012 CEST4434997513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:28.247107983 CEST49975443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:28.247179031 CEST4434997513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:28.247716904 CEST49975443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:28.247734070 CEST4434997513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:28.333709002 CEST4434997613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:28.334578037 CEST49976443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:28.334641933 CEST4434997613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:28.335184097 CEST49976443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:28.335202932 CEST4434997613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:28.344593048 CEST4434997513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:28.344753981 CEST4434997513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:28.344944000 CEST49975443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:28.345026970 CEST49975443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:28.345027924 CEST49975443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:28.345074892 CEST4434997513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:28.345109940 CEST4434997513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:28.348418951 CEST49980443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:28.348469973 CEST4434998013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:28.348572016 CEST49980443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:28.348752975 CEST49980443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:28.348772049 CEST4434998013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:28.436486959 CEST4434997613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:28.436531067 CEST4434997613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:28.436594009 CEST4434997613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:28.436625004 CEST49976443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:28.436697960 CEST49976443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:28.436954021 CEST49976443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:28.437006950 CEST4434997613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:28.437041044 CEST49976443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:28.437061071 CEST4434997613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:28.440710068 CEST49981443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:28.440808058 CEST4434998113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:28.440922976 CEST49981443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:28.441148996 CEST49981443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:28.441179037 CEST4434998113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:28.604552031 CEST4434997713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:28.608371019 CEST49977443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:28.608397961 CEST4434997713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:28.609318018 CEST49977443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:28.609323978 CEST4434997713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:28.611052036 CEST4434997813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:28.611417055 CEST49978443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:28.611422062 CEST4434997813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:28.611947060 CEST49978443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:28.611951113 CEST4434997813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:28.657807112 CEST4434997913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:28.658386946 CEST49979443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:28.658423901 CEST4434997913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:28.659147978 CEST49979443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:28.659161091 CEST4434997913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:28.707833052 CEST4434997713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:28.707916975 CEST4434997713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:28.707997084 CEST49977443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:28.708281040 CEST49977443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:28.708300114 CEST4434997713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:28.708314896 CEST49977443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:28.708319902 CEST4434997713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:28.712654114 CEST49982443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:28.712749004 CEST4434998213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:28.712873936 CEST49982443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:28.713089943 CEST49982443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:28.713119984 CEST4434998213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:28.714755058 CEST4434997813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:28.714790106 CEST4434997813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:28.714833021 CEST4434997813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:28.714876890 CEST49978443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:28.714991093 CEST49978443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:28.715044022 CEST49978443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:28.715044022 CEST49978443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:28.715055943 CEST4434997813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:28.715065002 CEST4434997813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:28.717675924 CEST49983443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:28.717713118 CEST4434998313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:28.717797041 CEST49983443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:28.717972040 CEST49983443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:28.717983007 CEST4434998313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:28.758714914 CEST4434997913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:28.758882999 CEST4434997913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:28.758970022 CEST49979443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:28.759129047 CEST49979443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:28.759162903 CEST4434997913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:28.759176970 CEST49979443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:28.759185076 CEST4434997913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:28.762924910 CEST49984443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:28.762979031 CEST4434998413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:28.763103008 CEST49984443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:28.763307095 CEST49984443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:28.763340950 CEST4434998413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:28.984875917 CEST4434998013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:28.985637903 CEST49980443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:28.985676050 CEST4434998013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:28.986176014 CEST49980443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:28.986186981 CEST4434998013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:29.080765963 CEST4434998113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:29.082057953 CEST49981443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:29.082137108 CEST4434998113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:29.083756924 CEST49981443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:29.083772898 CEST4434998113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:29.084103107 CEST4434998013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:29.084176064 CEST4434998013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:29.084235907 CEST49980443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:29.084276915 CEST4434998013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:29.084301949 CEST4434998013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:29.084355116 CEST49980443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:29.084487915 CEST49980443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:29.084510088 CEST4434998013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:29.084521055 CEST49980443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:29.084526062 CEST4434998013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:29.091944933 CEST49985443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:29.091984034 CEST4434998513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:29.092070103 CEST49985443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:29.096657991 CEST49985443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:29.096671104 CEST4434998513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:29.203046083 CEST4434998113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:29.203140020 CEST4434998113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:29.203221083 CEST49981443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:29.203576088 CEST49981443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:29.203598976 CEST4434998113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:29.203617096 CEST49981443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:29.203624010 CEST4434998113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:29.207829952 CEST49986443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:29.207859993 CEST4434998613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:29.207932949 CEST49986443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:29.208161116 CEST49986443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:29.208175898 CEST4434998613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:29.358493090 CEST4434998313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:29.359122038 CEST49983443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:29.359139919 CEST4434998313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:29.359838009 CEST49983443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:29.359843016 CEST4434998313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:29.390607119 CEST4434998213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:29.391273975 CEST49982443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:29.391355038 CEST4434998213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:29.391715050 CEST49982443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:29.391732931 CEST4434998213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:29.406163931 CEST4434998413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:29.406857967 CEST49984443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:29.406923056 CEST4434998413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:29.407150984 CEST49984443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:29.407166004 CEST4434998413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:29.457793951 CEST4434998313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:29.457920074 CEST4434998313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:29.458009958 CEST49983443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:29.458304882 CEST49983443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:29.458304882 CEST49983443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:29.458333969 CEST4434998313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:29.458345890 CEST4434998313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:29.462918997 CEST49987443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:29.463006973 CEST4434998713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:29.463107109 CEST49987443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:29.463295937 CEST49987443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:29.463329077 CEST4434998713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:29.493572950 CEST4434998213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:29.493606091 CEST4434998213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:29.493654013 CEST4434998213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:29.493707895 CEST49982443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:29.493767023 CEST49982443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:29.493956089 CEST49982443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:29.493998051 CEST4434998213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:29.494025946 CEST49982443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:29.494043112 CEST4434998213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:29.496853113 CEST49988443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:29.496881962 CEST4434998813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:29.496967077 CEST49988443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:29.497101068 CEST49988443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:29.497108936 CEST4434998813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:29.505013943 CEST4434998413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:29.505244970 CEST4434998413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:29.505469084 CEST49984443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:29.505469084 CEST49984443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:29.505469084 CEST49984443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:29.508353949 CEST49989443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:29.508405924 CEST4434998913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:29.508508921 CEST49989443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:29.508642912 CEST49989443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:29.508662939 CEST4434998913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:29.767844915 CEST4434998513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:29.773412943 CEST49985443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:29.773428917 CEST4434998513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:29.773948908 CEST49985443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:29.773957014 CEST4434998513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:29.818715096 CEST49984443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:29.818789959 CEST4434998413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:29.863900900 CEST4434998613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:29.864485979 CEST49986443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:29.864521980 CEST4434998613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:29.865158081 CEST49986443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:29.865165949 CEST4434998613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:29.872709036 CEST4434998513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:29.872769117 CEST4434998513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:29.872822046 CEST49985443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:29.872839928 CEST4434998513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:29.872873068 CEST4434998513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:29.872924089 CEST49985443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:29.873126984 CEST49985443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:29.873140097 CEST4434998513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:29.873155117 CEST49985443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:29.873159885 CEST4434998513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:29.877295971 CEST49990443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:29.877389908 CEST4434999013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:29.877501965 CEST49990443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:29.877640963 CEST49990443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:29.877660990 CEST4434999013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:29.970319033 CEST4434998613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:29.970457077 CEST4434998613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:29.970532894 CEST49986443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:29.970799923 CEST49986443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:29.970818996 CEST4434998613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:29.970849037 CEST49986443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:29.970854998 CEST4434998613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:29.974827051 CEST49991443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:29.974870920 CEST4434999113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:29.974967957 CEST49991443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:29.975169897 CEST49991443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:29.975188017 CEST4434999113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:30.127594948 CEST4434998713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:30.128318071 CEST49987443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:30.128420115 CEST4434998713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:30.129117966 CEST49987443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:30.129132032 CEST4434998713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:30.143446922 CEST4434998813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:30.144619942 CEST49988443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:30.144634008 CEST4434998813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:30.146059990 CEST49988443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:30.146064997 CEST4434998813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:30.147675037 CEST4434998913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:30.148538113 CEST49989443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:30.148570061 CEST4434998913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:30.149936914 CEST49989443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:30.149952888 CEST4434998913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:30.231453896 CEST4434998713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:30.231637001 CEST4434998713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:30.231759071 CEST49987443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:30.232090950 CEST49987443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:30.232090950 CEST49987443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:30.232148886 CEST4434998713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:30.232181072 CEST4434998713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:30.236010075 CEST49992443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:30.236082077 CEST4434999213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:30.236187935 CEST49992443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:30.236382961 CEST49992443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:30.236402035 CEST4434999213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:30.244894981 CEST4434998813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:30.245007992 CEST4434998813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:30.245055914 CEST4434998813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:30.245074987 CEST49988443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:30.245134115 CEST49988443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:30.247879982 CEST4434998913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:30.248039961 CEST4434998913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:30.248109102 CEST49989443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:30.248318911 CEST49988443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:30.248337984 CEST4434998813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:30.248348951 CEST49988443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:30.248354912 CEST4434998813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:30.248553991 CEST49989443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:30.248575926 CEST4434998913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:30.248589993 CEST49989443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:30.248596907 CEST4434998913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:30.327500105 CEST49993443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:30.327584028 CEST4434999313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:30.327702999 CEST49993443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:30.327888012 CEST49994443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:30.327899933 CEST4434999413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:30.327960014 CEST49994443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:30.328032017 CEST49993443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:30.328049898 CEST4434999313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:30.328104019 CEST49994443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:30.328119993 CEST4434999413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:30.518405914 CEST4434999013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:30.522346020 CEST49990443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:30.522408962 CEST4434999013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:30.525146008 CEST49990443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:30.525161982 CEST4434999013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:30.614061117 CEST4434999113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:30.615107059 CEST49991443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:30.615164042 CEST4434999113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:30.615863085 CEST49991443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:30.615880013 CEST4434999113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:30.620117903 CEST4434999013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:30.620153904 CEST4434999013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:30.620209932 CEST4434999013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:30.620238066 CEST49990443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:30.620301008 CEST49990443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:30.620601892 CEST49990443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:30.620621920 CEST4434999013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:30.620637894 CEST49990443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:30.620645046 CEST4434999013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:30.624255896 CEST49995443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:30.624299049 CEST4434999513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:30.624407053 CEST49995443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:30.624622107 CEST49995443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:30.624634027 CEST4434999513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:30.713745117 CEST4434999113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:30.713922977 CEST4434999113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:30.714025021 CEST49991443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:30.714173079 CEST49991443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:30.714201927 CEST4434999113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:30.714215994 CEST49991443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:30.714224100 CEST4434999113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:30.717595100 CEST49996443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:30.717650890 CEST4434999613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:30.717741013 CEST49996443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:30.717902899 CEST49996443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:30.717922926 CEST4434999613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:30.879143953 CEST4434999213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:30.880105972 CEST49992443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:30.880140066 CEST4434999213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:30.880687952 CEST49992443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:30.880698919 CEST4434999213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:30.976538897 CEST4434999413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:30.977191925 CEST49994443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:30.977242947 CEST4434999413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:30.977596045 CEST49994443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:30.977608919 CEST4434999413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:30.979208946 CEST4434999213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:30.979530096 CEST4434999213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:30.979598999 CEST49992443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:30.979686975 CEST49992443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:30.979686975 CEST49992443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:30.979736090 CEST4434999213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:30.979768038 CEST4434999213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:30.982861042 CEST49997443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:30.982908010 CEST4434999713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:30.982995987 CEST49997443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:30.983143091 CEST49997443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:30.983160973 CEST4434999713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:30.994263887 CEST4434999313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:30.994760990 CEST49993443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:30.994795084 CEST4434999313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:30.995183945 CEST49993443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:30.995193958 CEST4434999313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:31.078171015 CEST4434999413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:31.078258991 CEST4434999413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:31.078334093 CEST49994443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:31.078634024 CEST49994443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:31.078634024 CEST49994443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:31.078681946 CEST4434999413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:31.078707933 CEST4434999413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:31.084789991 CEST49998443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:31.084839106 CEST4434999813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:31.084911108 CEST49998443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:31.085933924 CEST49998443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:31.085953951 CEST4434999813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:31.098701954 CEST4434999313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:31.098773956 CEST4434999313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:31.098891973 CEST4434999313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:31.098912954 CEST49993443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:31.098954916 CEST49993443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:31.099016905 CEST49993443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:31.099041939 CEST4434999313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:31.099066019 CEST49993443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:31.099081993 CEST4434999313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:31.104319096 CEST49999443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:31.104384899 CEST4434999913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:31.104451895 CEST49999443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:31.104676962 CEST49999443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:31.104702950 CEST4434999913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:31.277057886 CEST4434999513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:31.277674913 CEST49995443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:31.277703047 CEST4434999513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:31.278227091 CEST49995443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:31.278239965 CEST4434999513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:31.367475033 CEST4434999613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:31.368175983 CEST49996443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:31.368252039 CEST4434999613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:31.368709087 CEST49996443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:31.368730068 CEST4434999613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:31.469083071 CEST4434999613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:31.469110966 CEST4434999613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:31.469141960 CEST4434999613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:31.469260931 CEST49996443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:31.469511986 CEST49996443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:31.469559908 CEST4434999613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:31.469594955 CEST49996443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:31.469614029 CEST4434999613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:31.472806931 CEST50000443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:31.472903967 CEST4435000013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:31.473012924 CEST50000443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:31.473164082 CEST50000443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:31.473200083 CEST4435000013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:31.601599932 CEST4434999513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:31.601946115 CEST4434999513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:31.602121115 CEST49995443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:31.602121115 CEST49995443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:31.602121115 CEST49995443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:31.605221987 CEST50001443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:31.605276108 CEST4435000113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:31.605361938 CEST50001443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:31.605519056 CEST50001443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:31.605535030 CEST4435000113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:31.622725010 CEST4434999713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:31.623289108 CEST49997443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:31.623311996 CEST4434999713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:31.623939037 CEST49997443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:31.623951912 CEST4434999713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:31.725034952 CEST4434999713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:31.725334883 CEST4434999713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:31.725414991 CEST49997443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:31.726584911 CEST49997443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:31.726623058 CEST4434999713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:31.726639032 CEST49997443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:31.726648092 CEST4434999713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:31.730037928 CEST50002443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:31.730101109 CEST4435000213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:31.730179071 CEST50002443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:31.730319977 CEST50002443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:31.730338097 CEST4435000213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:31.736206055 CEST4434999813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:31.736558914 CEST49998443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:31.736583948 CEST4434999813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:31.737019062 CEST49998443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:31.737027884 CEST4434999813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:31.742100954 CEST4434999913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:31.742568970 CEST49999443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:31.742599964 CEST4434999913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:31.742974043 CEST49999443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:31.742981911 CEST4434999913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:31.838211060 CEST4434999813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:31.838284016 CEST4434999813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:31.838360071 CEST4434999813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:31.838453054 CEST49998443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:31.838748932 CEST49998443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:31.838748932 CEST49998443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:31.841998100 CEST49998443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:31.842022896 CEST4434999813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:31.842017889 CEST50003443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:31.842106104 CEST4435000313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:31.842201948 CEST50003443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:31.842363119 CEST50003443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:31.842396021 CEST4435000313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:31.843373060 CEST4434999913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:31.843585014 CEST4434999913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:31.843673944 CEST49999443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:31.843738079 CEST49999443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:31.843738079 CEST49999443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:31.843780041 CEST4434999913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:31.843808889 CEST4434999913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:31.846159935 CEST50004443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:31.846203089 CEST4435000413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:31.846290112 CEST50004443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:31.846436024 CEST50004443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:31.846452951 CEST4435000413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:31.912969112 CEST49995443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:31.913008928 CEST4434999513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:32.107444048 CEST4435000013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:32.108084917 CEST50000443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:32.108170986 CEST4435000013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:32.108748913 CEST50000443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:32.108766079 CEST4435000013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:32.206574917 CEST4435000013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:32.206669092 CEST4435000013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:32.206864119 CEST50000443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:32.207004070 CEST50000443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:32.207060099 CEST4435000013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:32.207093000 CEST50000443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:32.207110882 CEST4435000013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:32.210689068 CEST50005443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:32.210791111 CEST4435000513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:32.210902929 CEST50005443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:32.211047888 CEST50005443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:32.211087942 CEST4435000513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:32.242571115 CEST4435000113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:32.243196964 CEST50001443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:32.243220091 CEST4435000113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:32.243762016 CEST50001443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:32.243767977 CEST4435000113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:32.341828108 CEST4435000113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:32.341916084 CEST4435000113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:32.341967106 CEST50001443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:32.342170000 CEST50001443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:32.342197895 CEST4435000113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:32.342212915 CEST50001443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:32.342220068 CEST4435000113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:32.345333099 CEST50006443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:32.345390081 CEST4435000613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:32.345463991 CEST50006443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:32.345613003 CEST50006443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:32.345629930 CEST4435000613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:32.392429113 CEST4435000213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:32.393038988 CEST50002443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:32.393071890 CEST4435000213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:32.393553019 CEST50002443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:32.393563032 CEST4435000213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:32.441289902 CEST49861443192.168.2.4142.250.185.68
                                                      Oct 7, 2024 13:24:32.441324949 CEST44349861142.250.185.68192.168.2.4
                                                      Oct 7, 2024 13:24:32.494980097 CEST4435000413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:32.495738983 CEST50004443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:32.495765924 CEST4435000413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:32.496227980 CEST50004443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:32.496232033 CEST4435000413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:32.507450104 CEST4435000213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:32.507582903 CEST4435000213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:32.507647038 CEST50002443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:32.507652044 CEST4435000213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:32.507714033 CEST50002443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:32.508271933 CEST50002443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:32.508306026 CEST4435000213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:32.508336067 CEST50002443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:32.508342981 CEST4435000213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:32.511838913 CEST50007443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:32.511873007 CEST4435000713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:32.511962891 CEST50007443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:32.512125015 CEST50007443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:32.512132883 CEST4435000713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:32.527510881 CEST4435000313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:32.528069973 CEST50003443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:32.528120995 CEST4435000313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:32.528595924 CEST50003443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:32.528609991 CEST4435000313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:32.593262911 CEST4435000413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:32.593338966 CEST4435000413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:32.593408108 CEST50004443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:32.593431950 CEST4435000413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:32.593456030 CEST4435000413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:32.593513966 CEST50004443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:32.593765020 CEST50004443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:32.593780994 CEST4435000413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:32.593791008 CEST50004443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:32.593799114 CEST4435000413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:32.596937895 CEST50008443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:32.597001076 CEST4435000813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:32.597064972 CEST50008443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:32.597265005 CEST50008443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:32.597290039 CEST4435000813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:32.632215977 CEST4435000313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:32.632481098 CEST4435000313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:32.632590055 CEST50003443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:32.634023905 CEST50003443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:32.634068012 CEST4435000313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:32.634099960 CEST50003443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:32.634116888 CEST4435000313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:32.638201952 CEST50009443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:32.638302088 CEST4435000913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:32.638426065 CEST50009443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:32.638577938 CEST50009443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:32.638607979 CEST4435000913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:32.872677088 CEST4435000513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:32.915846109 CEST50005443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:32.983830929 CEST4435000613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.026040077 CEST50005443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:33.026083946 CEST4435000513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.026679993 CEST50005443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:33.026695013 CEST4435000513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.029078007 CEST50006443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:33.029115915 CEST4435000613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.029639006 CEST50006443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:33.029650927 CEST4435000613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.125814915 CEST4435000613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.125843048 CEST4435000613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.125900984 CEST4435000613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.125953913 CEST50006443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:33.125955105 CEST50006443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:33.126610994 CEST4435000513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.126703024 CEST4435000513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.126759052 CEST50005443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:33.128766060 CEST50006443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:33.128766060 CEST50006443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:33.128812075 CEST4435000613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.128839016 CEST4435000613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.139830112 CEST50005443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:33.139858961 CEST4435000513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.139883995 CEST50005443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:33.139898062 CEST4435000513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.148984909 CEST4435000713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.159208059 CEST50007443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:33.159223080 CEST4435000713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.159591913 CEST50007443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:33.159595966 CEST4435000713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.166124105 CEST50010443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:33.166177988 CEST4435001013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.166248083 CEST50010443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:33.166493893 CEST50010443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:33.166508913 CEST4435001013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.168967009 CEST50011443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:33.169015884 CEST4435001113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.169068098 CEST50011443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:33.171822071 CEST50011443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:33.171843052 CEST4435001113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.249211073 CEST4435000813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.256048918 CEST50008443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:33.256102085 CEST4435000813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.256442070 CEST50008443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:33.256449938 CEST4435000813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.274154902 CEST4435000913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.274648905 CEST50009443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:33.274678946 CEST4435000913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.275032997 CEST50009443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:33.275038958 CEST4435000913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.290498018 CEST4435000713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.290649891 CEST4435000713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.290796041 CEST50007443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:33.290831089 CEST50007443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:33.290853977 CEST4435000713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.290865898 CEST50007443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:33.290873051 CEST4435000713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.293976068 CEST50012443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:33.294037104 CEST4435001213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.294122934 CEST50012443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:33.294308901 CEST50012443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:33.294328928 CEST4435001213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.353427887 CEST4435000813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.353606939 CEST4435000813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.353696108 CEST50008443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:33.353966951 CEST50008443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:33.353991985 CEST4435000813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.354031086 CEST50008443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:33.354039907 CEST4435000813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.357060909 CEST50013443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:33.357109070 CEST4435001313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.357202053 CEST50013443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:33.357434034 CEST50013443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:33.357446909 CEST4435001313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.375683069 CEST4435000913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.376218081 CEST4435000913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.376302004 CEST50009443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:33.376348972 CEST50009443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:33.376374006 CEST4435000913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.376393080 CEST50009443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:33.376401901 CEST4435000913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.378828049 CEST50014443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:33.378840923 CEST4435001413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.378928900 CEST50014443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:33.379163027 CEST50014443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:33.379173994 CEST4435001413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.831631899 CEST4435001113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.832139015 CEST50011443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:33.832181931 CEST4435001113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.832581043 CEST50011443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:33.832588911 CEST4435001113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.832632065 CEST4435001013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.832895994 CEST50010443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:33.832968950 CEST4435001013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.833225965 CEST50010443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:33.833240986 CEST4435001013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.933669090 CEST4435001213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.934150934 CEST50012443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:33.934200048 CEST4435001213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.934556007 CEST50012443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:33.934565067 CEST4435001213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.935347080 CEST4435001113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.935426950 CEST4435001113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.935477972 CEST50011443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:33.935573101 CEST50011443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:33.935591936 CEST4435001113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.935623884 CEST50011443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:33.935631037 CEST4435001113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.936096907 CEST4435001013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.936136007 CEST4435001013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.936186075 CEST50010443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:33.936196089 CEST4435001013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.936239958 CEST50010443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:33.936320066 CEST50010443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:33.936343908 CEST4435001013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.936358929 CEST50010443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:33.936367035 CEST4435001013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.937922001 CEST50016443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:33.937967062 CEST4435001613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.938044071 CEST50016443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:33.938043118 CEST50017443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:33.938086987 CEST4435001713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.938143015 CEST50017443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:33.938147068 CEST50016443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:33.938160896 CEST4435001613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:33.938286066 CEST50017443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:33.938296080 CEST4435001713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:35.051476002 CEST4435001213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:35.051621914 CEST4435001213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:35.051769972 CEST50012443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:35.051856995 CEST50012443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:35.051856995 CEST50012443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:35.051909924 CEST4435001213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:35.051938057 CEST4435001213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:35.053155899 CEST4435001413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:35.053988934 CEST50014443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:35.054024935 CEST4435001413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:35.054349899 CEST50018443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:35.054380894 CEST4435001813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:35.054428101 CEST50014443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:35.054431915 CEST4435001413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:35.054461002 CEST50018443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:35.054555893 CEST50018443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:35.054558992 CEST4435001813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:35.058028936 CEST4435001313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:35.058320045 CEST50013443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:35.058332920 CEST4435001313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:35.058655977 CEST50013443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:35.058659077 CEST4435001313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:35.157726049 CEST4435001313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:35.158041000 CEST4435001313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:35.158143997 CEST50013443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:35.158385992 CEST4435001413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:35.158456087 CEST50013443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:35.158456087 CEST50013443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:35.158476114 CEST4435001313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:35.158483982 CEST4435001413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:35.158485889 CEST4435001313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:35.158535004 CEST50014443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:35.159477949 CEST50014443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:35.159482956 CEST4435001413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:35.159492016 CEST50014443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:35.159498930 CEST4435001413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:35.161678076 CEST50019443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:35.161760092 CEST4435001913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:35.161844015 CEST50019443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:35.162348986 CEST50019443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:35.162360907 CEST50020443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:35.162383080 CEST4435001913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:35.162401915 CEST4435002013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:35.162508965 CEST50020443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:35.162555933 CEST50020443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:35.162564039 CEST4435002013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:35.249387980 CEST4435001713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:35.251972914 CEST4435001613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:35.252542019 CEST50017443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:35.252621889 CEST4435001713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:35.252826929 CEST50017443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:35.252841949 CEST4435001713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:35.253000975 CEST50016443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:35.253031015 CEST4435001613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:35.253305912 CEST50016443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:35.253318071 CEST4435001613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:35.352823973 CEST4435001713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:35.352914095 CEST4435001713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:35.353012085 CEST50017443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:35.356637955 CEST4435001613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:35.356998920 CEST4435001613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:35.357084990 CEST50016443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:35.365751028 CEST50017443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:35.365751028 CEST50017443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:35.365803003 CEST4435001713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:35.365833998 CEST4435001713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:35.366950035 CEST50016443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:35.366950989 CEST50016443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:35.366995096 CEST4435001613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:35.367022038 CEST4435001613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:35.369426966 CEST50021443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:35.369527102 CEST4435002113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:35.369621038 CEST50021443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:35.370354891 CEST50022443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:35.370378017 CEST4435002213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:35.370450020 CEST50022443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:35.370524883 CEST50021443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:35.370559931 CEST4435002113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:35.370637894 CEST50022443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:35.370662928 CEST4435002213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:35.699306011 CEST4435001813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:35.699855089 CEST50018443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:35.699911118 CEST4435001813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:35.700154066 CEST50018443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:35.700165033 CEST4435001813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:35.798093081 CEST4435001813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:35.799485922 CEST4435001813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:35.799668074 CEST50018443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:35.799668074 CEST50018443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:35.799668074 CEST50018443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:35.801886082 CEST50023443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:35.801929951 CEST4435002313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:35.802001953 CEST50023443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:35.802141905 CEST50023443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:35.802159071 CEST4435002313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:35.805694103 CEST4435002013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:35.806014061 CEST50020443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:35.806042910 CEST4435002013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:35.806360006 CEST50020443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:35.806370974 CEST4435002013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:35.844269991 CEST4435001913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:35.844594002 CEST50019443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:35.844626904 CEST4435001913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:35.845004082 CEST50019443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:35.845016956 CEST4435001913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:35.905229092 CEST4435002013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:35.905630112 CEST4435002013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:35.905739069 CEST4435002013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:35.905826092 CEST50020443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:35.905846119 CEST50020443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:35.905846119 CEST50020443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:35.907627106 CEST50020443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:35.907639980 CEST50024443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:35.907646894 CEST4435002013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:35.907713890 CEST4435002413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:35.907790899 CEST50024443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:35.907881975 CEST50024443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:35.907900095 CEST4435002413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:35.947727919 CEST4435001913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:35.947973967 CEST4435001913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:35.948159933 CEST50019443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:35.948160887 CEST50019443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:35.948160887 CEST50019443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:35.949692011 CEST50025443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:35.949789047 CEST4435002513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:35.949881077 CEST50025443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:35.950009108 CEST50025443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:35.950045109 CEST4435002513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.007433891 CEST4435002113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.008069038 CEST50021443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:36.008153915 CEST4435002113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.008588076 CEST50021443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:36.008604050 CEST4435002113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.031716108 CEST4435002213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.032006025 CEST50022443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:36.032049894 CEST4435002213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.032335043 CEST50022443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:36.032347918 CEST4435002213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.100567102 CEST50018443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:36.100609064 CEST4435001813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.106652021 CEST4435002113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.106688976 CEST4435002113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.106739044 CEST50021443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:36.106767893 CEST4435002113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.106785059 CEST4435002113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.106849909 CEST50021443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:36.107042074 CEST50021443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:36.107080936 CEST4435002113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.107108116 CEST50021443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:36.107125998 CEST4435002113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.110877991 CEST50026443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:36.110946894 CEST4435002613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.111026049 CEST50026443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:36.111198902 CEST50026443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:36.111217022 CEST4435002613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.135097980 CEST4435002213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.135763884 CEST4435002213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.135862112 CEST50022443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:36.136010885 CEST50022443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:36.136039019 CEST4435002213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.136065960 CEST50022443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:36.136079073 CEST4435002213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.139570951 CEST50027443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:36.139599085 CEST4435002713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.139658928 CEST50027443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:36.139945984 CEST50027443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:36.139955044 CEST4435002713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.256769896 CEST50019443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:36.256846905 CEST4435001913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.447771072 CEST4435002313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.448244095 CEST50023443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:36.448285103 CEST4435002313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.448611975 CEST50023443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:36.448618889 CEST4435002313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.547744989 CEST4435002313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.547815084 CEST4435002313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.547916889 CEST50023443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:36.547928095 CEST4435002313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.547988892 CEST50023443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:36.548051119 CEST50023443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:36.548074961 CEST4435002313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.548114061 CEST50023443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:36.548119068 CEST4435002313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.550549030 CEST50028443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:36.550616026 CEST4435002813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.550694942 CEST50028443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:36.550827980 CEST50028443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:36.550834894 CEST4435002813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.583518028 CEST4435002513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.583848000 CEST50025443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:36.583940983 CEST4435002513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.584165096 CEST50025443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:36.584186077 CEST4435002513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.585930109 CEST4435002413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.586167097 CEST50024443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:36.586214066 CEST4435002413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.586457014 CEST50024443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:36.586468935 CEST4435002413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.683178902 CEST4435002513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.683530092 CEST4435002513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.683732033 CEST50025443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:36.683732986 CEST50025443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:36.683830976 CEST50025443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:36.683872938 CEST4435002513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.686330080 CEST50029443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:36.686367989 CEST4435002913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.686429024 CEST50029443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:36.686549902 CEST50029443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:36.686558962 CEST4435002913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.691054106 CEST4435002413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.691112041 CEST4435002413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.691162109 CEST50024443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:36.691441059 CEST50024443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:36.691456079 CEST4435002413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.691468000 CEST50024443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:36.691473007 CEST4435002413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.694726944 CEST50030443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:36.694740057 CEST4435003013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.694827080 CEST50030443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:36.695029974 CEST50030443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:36.695045948 CEST4435003013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.757157087 CEST4435002613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.757803917 CEST50026443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:36.757869959 CEST4435002613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.758142948 CEST50026443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:36.758158922 CEST4435002613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.792737007 CEST4435002713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.793705940 CEST50027443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:36.793735027 CEST4435002713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.794414043 CEST50027443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:36.794426918 CEST4435002713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.858656883 CEST4435002613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.858874083 CEST4435002613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.858985901 CEST50026443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:36.859168053 CEST50026443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:36.859215975 CEST4435002613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.859246969 CEST50026443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:36.859265089 CEST4435002613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.863020897 CEST50031443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:36.863059998 CEST4435003113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.863159895 CEST50031443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:36.863348007 CEST50031443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:36.863359928 CEST4435003113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.893610954 CEST4435002713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.893676996 CEST4435002713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.893779993 CEST4435002713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.893798113 CEST50027443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:36.893935919 CEST50027443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:36.894234896 CEST50027443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:36.894272089 CEST4435002713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.894300938 CEST50027443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:36.894315958 CEST4435002713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.897934914 CEST50032443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:36.898020029 CEST4435003213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:36.898114920 CEST50032443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:36.898298979 CEST50032443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:36.898333073 CEST4435003213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:37.246160984 CEST4435002813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:37.246675968 CEST50028443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:37.246716976 CEST4435002813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:37.247179985 CEST50028443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:37.247201920 CEST4435002813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:37.320219040 CEST4435002913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:37.320815086 CEST50029443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:37.320863962 CEST4435002913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:37.321259975 CEST50029443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:37.321268082 CEST4435002913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:37.355573893 CEST4435003013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:37.358010054 CEST50030443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:37.358084917 CEST4435003013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:37.358417034 CEST50030443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:37.358424902 CEST4435003013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:37.363929987 CEST4435002813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:37.364099979 CEST4435002813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:37.364187956 CEST50028443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:37.364299059 CEST50028443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:37.364326954 CEST4435002813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:37.364339113 CEST50028443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:37.364343882 CEST4435002813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:37.367679119 CEST50033443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:37.367727995 CEST4435003313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:37.367834091 CEST50033443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:37.367964029 CEST50033443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:37.367969990 CEST4435003313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:37.418515921 CEST4435002913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:37.418916941 CEST4435002913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:37.419049978 CEST50029443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:37.419104099 CEST50029443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:37.419104099 CEST50029443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:37.419130087 CEST4435002913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:37.419145107 CEST4435002913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:37.422343016 CEST50034443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:37.422363997 CEST4435003413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:37.422466993 CEST50034443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:37.422653913 CEST50034443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:37.422669888 CEST4435003413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:37.473342896 CEST4435003013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:37.473361969 CEST4435003013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:37.473402023 CEST4435003013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:37.473479986 CEST50030443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:37.473520994 CEST50030443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:37.473804951 CEST50030443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:37.473829031 CEST4435003013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:37.473840952 CEST50030443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:37.473845959 CEST4435003013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:37.477134943 CEST50035443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:37.477215052 CEST4435003513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:37.477330923 CEST50035443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:37.477462053 CEST50035443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:37.477482080 CEST4435003513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:37.498761892 CEST6288753192.168.2.41.1.1.1
                                                      Oct 7, 2024 13:24:37.499587059 CEST4435003113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:37.500072002 CEST50031443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:37.500093937 CEST4435003113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:37.500516891 CEST50031443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:37.500520945 CEST4435003113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:37.504426003 CEST53628871.1.1.1192.168.2.4
                                                      Oct 7, 2024 13:24:37.504508972 CEST6288753192.168.2.41.1.1.1
                                                      Oct 7, 2024 13:24:37.504548073 CEST6288753192.168.2.41.1.1.1
                                                      Oct 7, 2024 13:24:37.509449959 CEST53628871.1.1.1192.168.2.4
                                                      Oct 7, 2024 13:24:37.568259954 CEST4435003213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:37.569091082 CEST50032443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:37.569147110 CEST4435003213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:37.569612026 CEST50032443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:37.569623947 CEST4435003213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:37.672957897 CEST4435003213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:37.673011065 CEST4435003213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:37.673103094 CEST50032443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:37.673135042 CEST4435003213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:37.673198938 CEST50032443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:37.673397064 CEST50032443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:37.673444986 CEST4435003213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:37.673476934 CEST50032443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:37.673492908 CEST4435003213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:37.676136017 CEST62888443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:37.676163912 CEST4436288813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:37.676230907 CEST62888443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:37.676359892 CEST62888443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:37.676371098 CEST4436288813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:37.916196108 CEST4435003113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:37.916359901 CEST4435003113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:37.916419983 CEST50031443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:37.969759941 CEST50031443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:37.969782114 CEST4435003113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:37.969795942 CEST50031443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:37.969800949 CEST4435003113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:37.977457047 CEST62889443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:37.977557898 CEST4436288913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:37.977648973 CEST62889443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:37.977840900 CEST62889443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:37.977865934 CEST4436288913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:38.201661110 CEST53628871.1.1.1192.168.2.4
                                                      Oct 7, 2024 13:24:38.203021049 CEST6288753192.168.2.41.1.1.1
                                                      Oct 7, 2024 13:24:38.208327055 CEST53628871.1.1.1192.168.2.4
                                                      Oct 7, 2024 13:24:38.208420992 CEST6288753192.168.2.41.1.1.1
                                                      Oct 7, 2024 13:24:38.295630932 CEST4435003313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:38.296178102 CEST50033443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:38.296195030 CEST4435003313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:38.296688080 CEST50033443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:38.296693087 CEST4435003313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:38.381850958 CEST4435003513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:38.383263111 CEST50035443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:38.383339882 CEST4435003513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:38.383683920 CEST50035443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:38.383698940 CEST4435003513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:38.395648003 CEST4435003313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:38.395701885 CEST4435003313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:38.395793915 CEST50033443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:38.395814896 CEST4435003313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:38.395834923 CEST4435003313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:38.395977020 CEST50033443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:38.396120071 CEST50033443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:38.396147966 CEST4435003313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:38.396161079 CEST50033443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:38.396168947 CEST4435003313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:38.399708986 CEST62891443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:38.399734974 CEST4436289113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:38.399801970 CEST62891443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:38.399959087 CEST62891443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:38.399969101 CEST4436289113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:38.418119907 CEST4435003413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:38.418601990 CEST50034443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:38.418615103 CEST4435003413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:38.419157982 CEST50034443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:38.419162989 CEST4435003413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:38.485871077 CEST4435003513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:38.485883951 CEST4435003513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:38.486001015 CEST4435003513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:38.486098051 CEST50035443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:38.486099005 CEST50035443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:38.486227989 CEST50035443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:38.486263037 CEST4435003513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:38.486293077 CEST50035443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:38.486310959 CEST4435003513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:38.489300966 CEST62892443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:38.489382029 CEST4436289213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:38.489481926 CEST62892443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:38.489624023 CEST62892443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:38.489656925 CEST4436289213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:38.574922085 CEST4436288813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:38.575561047 CEST62888443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:38.575575113 CEST4436288813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:38.576200962 CEST62888443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:38.576205015 CEST4436288813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:38.634644985 CEST4436288913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:38.635135889 CEST62889443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:38.635231018 CEST4436288913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:38.635375023 CEST62889443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:38.635394096 CEST4436288913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:38.679274082 CEST4436288813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:38.679461002 CEST4436288813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:38.679528952 CEST62888443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:38.679668903 CEST62888443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:38.679713011 CEST4436288813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:38.679744005 CEST62888443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:38.679759979 CEST4436288813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:38.682657003 CEST62893443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:38.682701111 CEST4436289313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:38.682777882 CEST62893443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:38.682915926 CEST62893443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:38.682928085 CEST4436289313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:38.716932058 CEST4435003413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:38.716989040 CEST4435003413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:38.717045069 CEST50034443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:38.717063904 CEST4435003413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:38.717171907 CEST4435003413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:38.717225075 CEST50034443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:38.717272997 CEST50034443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:38.717287064 CEST4435003413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:38.717294931 CEST50034443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:38.717299938 CEST4435003413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:38.720050097 CEST62894443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:38.720067978 CEST4436289413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:38.720185995 CEST62894443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:38.720316887 CEST62894443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:38.720347881 CEST4436289413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:38.733697891 CEST4436288913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:38.733854055 CEST4436288913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:38.733935118 CEST62889443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:38.734019041 CEST62889443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:38.734019041 CEST62889443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:38.734062910 CEST4436288913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:38.734090090 CEST4436288913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:38.736236095 CEST62895443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:38.736295938 CEST4436289513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:38.736399889 CEST62895443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:38.736534119 CEST62895443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:38.736565113 CEST4436289513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.037766933 CEST4436289113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.038378954 CEST62891443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:39.038393974 CEST4436289113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.039221048 CEST62891443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:39.039225101 CEST4436289113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.122626066 CEST4436289213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.123459101 CEST62892443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:39.123547077 CEST4436289213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.123980999 CEST62892443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:39.123996973 CEST4436289213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.141222000 CEST4436289113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.141377926 CEST4436289113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.141434908 CEST62891443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:39.145414114 CEST62891443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:39.145425081 CEST4436289113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.145432949 CEST62891443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:39.145437002 CEST4436289113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.153115988 CEST62896443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:39.153198957 CEST4436289613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.153311014 CEST62896443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:39.153449059 CEST62896443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:39.153471947 CEST4436289613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.231604099 CEST4436289213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.232599020 CEST4436289213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.232664108 CEST62892443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:39.232830048 CEST62892443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:39.232831001 CEST62892443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:39.232847929 CEST4436289213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.232861042 CEST4436289213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.235593081 CEST62897443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:39.235641003 CEST4436289713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.235704899 CEST62897443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:39.235841036 CEST62897443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:39.235857010 CEST4436289713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.349400043 CEST4436289313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.349957943 CEST62893443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:39.349981070 CEST4436289313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.351465940 CEST62893443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:39.351474047 CEST4436289313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.368767977 CEST4436289413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.370778084 CEST62894443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:39.370798111 CEST4436289413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.371187925 CEST62894443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:39.371193886 CEST4436289413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.383368969 CEST4436289513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.384836912 CEST62895443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:39.384855032 CEST4436289513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.385209084 CEST62895443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:39.385215044 CEST4436289513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.453480005 CEST4436289313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.453535080 CEST4436289313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.453627110 CEST62893443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:39.453644037 CEST4436289313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.453676939 CEST4436289313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.453736067 CEST62893443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:39.453877926 CEST62893443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:39.453897953 CEST4436289313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.453910112 CEST62893443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:39.453916073 CEST4436289313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.456809998 CEST62898443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:39.456841946 CEST4436289813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.456943989 CEST62898443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:39.457109928 CEST62898443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:39.457127094 CEST4436289813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.471483946 CEST4436289413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.471522093 CEST4436289413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.471577883 CEST4436289413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.471611977 CEST62894443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:39.471645117 CEST62894443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:39.471832037 CEST62894443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:39.471849918 CEST4436289413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.471860886 CEST62894443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:39.471865892 CEST4436289413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.473903894 CEST62899443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:39.473980904 CEST4436289913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.474061966 CEST62899443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:39.474186897 CEST62899443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:39.474220037 CEST4436289913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.488985062 CEST4436289513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.489007950 CEST4436289513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.489022970 CEST4436289513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.489082098 CEST62895443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:39.489100933 CEST4436289513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.489156961 CEST62895443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:39.572817087 CEST4436289513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.572875023 CEST4436289513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.573044062 CEST62895443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:39.573044062 CEST62895443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:39.575728893 CEST62895443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:39.575776100 CEST4436289513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.575809956 CEST62895443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:39.575825930 CEST4436289513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.579221964 CEST62900443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:39.579307079 CEST4436290013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.579404116 CEST62900443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:39.579667091 CEST62900443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:39.579703093 CEST4436290013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.801292896 CEST4436289613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.801896095 CEST62896443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:39.801949978 CEST4436289613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.802720070 CEST62896443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:39.802732944 CEST4436289613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.867881060 CEST4436289713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.871887922 CEST62897443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:39.871910095 CEST4436289713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.900113106 CEST62897443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:39.900124073 CEST4436289713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.903049946 CEST4436289613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.903073072 CEST4436289613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.903152943 CEST62896443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:39.903187037 CEST4436289613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.903522015 CEST4436289613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.905411005 CEST62896443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:39.905456066 CEST4436289613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.905487061 CEST62896443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:39.905487061 CEST62896443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:39.905509949 CEST4436289613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.905529022 CEST4436289613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.917272091 CEST62901443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:39.917390108 CEST4436290113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:39.917495966 CEST62901443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:39.917640924 CEST62901443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:39.917680025 CEST4436290113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.002137899 CEST4436289713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.002161026 CEST4436289713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.002274990 CEST4436289713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.002476931 CEST62897443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:40.002477884 CEST62897443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:40.002510071 CEST4436289713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.002566099 CEST62897443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:40.087255955 CEST4436289713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.087311983 CEST4436289713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.087326050 CEST4436289713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.087362051 CEST62897443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:40.087413073 CEST62897443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:40.087651014 CEST62897443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:40.087673903 CEST4436289713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.087685108 CEST62897443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:40.087691069 CEST4436289713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.098210096 CEST62902443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:40.098259926 CEST4436290213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.098351002 CEST62902443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:40.110812902 CEST62902443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:40.110833883 CEST4436290213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.115667105 CEST4436289913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.118067026 CEST62899443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:40.118134975 CEST4436289913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.118715048 CEST62899443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:40.118731022 CEST4436289913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.126271009 CEST4436289813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.126655102 CEST62898443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:40.126678944 CEST4436289813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.127336025 CEST62898443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:40.127341032 CEST4436289813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.213722944 CEST4436289913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.213776112 CEST4436289913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.213845015 CEST62899443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:40.213876963 CEST4436289913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.213915110 CEST4436289913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.213992119 CEST62899443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:40.214265108 CEST62899443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:40.214301109 CEST4436289913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.214332104 CEST62899443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:40.214346886 CEST4436289913.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.222619057 CEST62903443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:40.222707033 CEST4436290313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.222801924 CEST62903443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:40.222969055 CEST62903443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:40.223002911 CEST4436290313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.227833986 CEST4436289813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.227885962 CEST4436290013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.227902889 CEST4436289813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.227987051 CEST62898443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:40.227998972 CEST4436289813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.228142977 CEST4436289813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.228199959 CEST62898443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:40.272329092 CEST62900443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:40.279644012 CEST62898443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:40.279683113 CEST4436289813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.279695034 CEST62898443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:40.279700994 CEST4436289813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.281295061 CEST62900443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:40.281307936 CEST4436290013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.281866074 CEST62900443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:40.281877041 CEST4436290013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.284878016 CEST62904443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:40.284939051 CEST4436290413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.285152912 CEST62904443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:40.285476923 CEST62904443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:40.285495996 CEST4436290413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.555756092 CEST4436290013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.555919886 CEST4436290013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.556008101 CEST62900443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:40.556170940 CEST62900443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:40.556216955 CEST4436290013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.556248903 CEST62900443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:40.556266069 CEST4436290013.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.559317112 CEST62905443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:40.559355974 CEST4436290513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.559442043 CEST62905443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:40.559601068 CEST62905443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:40.559617043 CEST4436290513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.751348972 CEST4436290213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.752180099 CEST62902443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:40.752268076 CEST4436290213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.752912045 CEST62902443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:40.752927065 CEST4436290213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.754894018 CEST4436290113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.755364895 CEST62901443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:40.755382061 CEST4436290113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.755908012 CEST62901443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:40.755919933 CEST4436290113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.850697041 CEST4436290213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.850893974 CEST4436290213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.851037979 CEST62902443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:40.851238966 CEST62902443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:40.851280928 CEST4436290213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.851309061 CEST62902443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:40.851324081 CEST4436290213.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.854798079 CEST62906443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:40.854897022 CEST4436290613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.855007887 CEST62906443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:40.855222940 CEST62906443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:40.855262041 CEST4436290613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.857495070 CEST4436290113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.857651949 CEST4436290113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.857723951 CEST62901443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:40.857754946 CEST62901443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:40.857772112 CEST4436290113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.857793093 CEST62901443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:40.857804060 CEST4436290113.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.860167027 CEST62907443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:40.860209942 CEST4436290713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.860299110 CEST62907443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:40.860457897 CEST62907443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:40.860472918 CEST4436290713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.868040085 CEST4436290313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.868498087 CEST62903443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:40.868556976 CEST4436290313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.869054079 CEST62903443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:40.869067907 CEST4436290313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.953810930 CEST4436290413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.954334021 CEST62904443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:40.954370975 CEST4436290413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.954758883 CEST62904443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:40.954766035 CEST4436290413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.968288898 CEST4436290313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.968455076 CEST4436290313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.968568087 CEST62903443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:40.968631029 CEST62903443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:40.968664885 CEST4436290313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.968712091 CEST62903443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:40.968728065 CEST4436290313.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.971246004 CEST62908443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:40.971358061 CEST4436290813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:40.971450090 CEST62908443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:40.971626997 CEST62908443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:40.971666098 CEST4436290813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:41.055808067 CEST4436290413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:41.055876017 CEST4436290413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:41.055986881 CEST4436290413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:41.055990934 CEST62904443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:41.056046009 CEST62904443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:41.056329966 CEST62904443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:41.056349993 CEST4436290413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:41.056361914 CEST62904443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:41.056366920 CEST4436290413.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:41.216681957 CEST4436290513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:41.217225075 CEST62905443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:41.217257023 CEST4436290513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:41.217787981 CEST62905443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:41.217793941 CEST4436290513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:41.316668987 CEST4436290513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:41.316822052 CEST4436290513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:41.317003965 CEST62905443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:41.317075968 CEST62905443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:41.317097902 CEST4436290513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:41.317110062 CEST62905443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:41.317117929 CEST4436290513.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:41.502175093 CEST4436290713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:41.502604008 CEST4436290613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:41.502787113 CEST62907443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:41.502832890 CEST4436290713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:41.503082037 CEST62906443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:41.503175020 CEST4436290613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:41.503218889 CEST62907443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:41.503223896 CEST4436290713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:41.503659964 CEST62906443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:41.503675938 CEST4436290613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:41.604010105 CEST4436290713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:41.604288101 CEST4436290713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:41.604393959 CEST62907443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:41.604463100 CEST62907443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:41.604463100 CEST62907443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:41.604502916 CEST4436290713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:41.604530096 CEST4436290713.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:41.604823112 CEST4436290613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:41.605014086 CEST4436290613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:41.605096102 CEST62906443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:41.605355978 CEST62906443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:41.605355978 CEST62906443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:41.605403900 CEST4436290613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:41.605437994 CEST4436290613.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:41.613387108 CEST4436290813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:41.613883018 CEST62908443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:41.613918066 CEST4436290813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:41.614275932 CEST62908443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:41.614305019 CEST4436290813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:41.711654902 CEST4436290813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:41.711827993 CEST4436290813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:41.711931944 CEST62908443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:41.712280035 CEST62908443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:41.712327957 CEST4436290813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:41.712359905 CEST62908443192.168.2.413.107.246.45
                                                      Oct 7, 2024 13:24:41.712377071 CEST4436290813.107.246.45192.168.2.4
                                                      Oct 7, 2024 13:24:49.355189085 CEST62909443192.168.2.4142.250.186.110
                                                      Oct 7, 2024 13:24:49.355293036 CEST44362909142.250.186.110192.168.2.4
                                                      Oct 7, 2024 13:24:49.355484009 CEST62909443192.168.2.4142.250.186.110
                                                      Oct 7, 2024 13:24:49.357461929 CEST62909443192.168.2.4142.250.186.110
                                                      Oct 7, 2024 13:24:49.357546091 CEST44362909142.250.186.110192.168.2.4
                                                      Oct 7, 2024 13:24:49.920595884 CEST62910443192.168.2.4142.250.186.110
                                                      Oct 7, 2024 13:24:49.920708895 CEST44362910142.250.186.110192.168.2.4
                                                      Oct 7, 2024 13:24:49.921041965 CEST62910443192.168.2.4142.250.186.110
                                                      Oct 7, 2024 13:24:49.921160936 CEST62910443192.168.2.4142.250.186.110
                                                      Oct 7, 2024 13:24:49.921194077 CEST44362910142.250.186.110192.168.2.4
                                                      Oct 7, 2024 13:24:50.988590002 CEST44362910142.250.186.110192.168.2.4
                                                      Oct 7, 2024 13:24:50.989305973 CEST62910443192.168.2.4142.250.186.110
                                                      Oct 7, 2024 13:24:50.989371061 CEST44362910142.250.186.110192.168.2.4
                                                      Oct 7, 2024 13:24:50.990128994 CEST44362910142.250.186.110192.168.2.4
                                                      Oct 7, 2024 13:24:50.990561962 CEST62910443192.168.2.4142.250.186.110
                                                      Oct 7, 2024 13:24:50.990621090 CEST62910443192.168.2.4142.250.186.110
                                                      Oct 7, 2024 13:24:50.990644932 CEST44362910142.250.186.110192.168.2.4
                                                      Oct 7, 2024 13:24:50.990667105 CEST44362910142.250.186.110192.168.2.4
                                                      Oct 7, 2024 13:24:50.990672112 CEST62910443192.168.2.4142.250.186.110
                                                      Oct 7, 2024 13:24:51.031431913 CEST44362910142.250.186.110192.168.2.4
                                                      Oct 7, 2024 13:24:51.038254976 CEST62910443192.168.2.4142.250.186.110
                                                      Oct 7, 2024 13:24:51.066421032 CEST44362909142.250.186.110192.168.2.4
                                                      Oct 7, 2024 13:24:51.066962004 CEST62909443192.168.2.4142.250.186.110
                                                      Oct 7, 2024 13:24:51.067023039 CEST44362909142.250.186.110192.168.2.4
                                                      Oct 7, 2024 13:24:51.067806005 CEST44362909142.250.186.110192.168.2.4
                                                      Oct 7, 2024 13:24:51.068294048 CEST62909443192.168.2.4142.250.186.110
                                                      Oct 7, 2024 13:24:51.068341970 CEST62909443192.168.2.4142.250.186.110
                                                      Oct 7, 2024 13:24:51.068341970 CEST62909443192.168.2.4142.250.186.110
                                                      Oct 7, 2024 13:24:51.068362951 CEST44362909142.250.186.110192.168.2.4
                                                      Oct 7, 2024 13:24:51.068393946 CEST44362909142.250.186.110192.168.2.4
                                                      Oct 7, 2024 13:24:51.116120100 CEST62909443192.168.2.4142.250.186.110
                                                      Oct 7, 2024 13:24:51.290990114 CEST44362910142.250.186.110192.168.2.4
                                                      Oct 7, 2024 13:24:51.291202068 CEST44362910142.250.186.110192.168.2.4
                                                      Oct 7, 2024 13:24:51.291371107 CEST62910443192.168.2.4142.250.186.110
                                                      Oct 7, 2024 13:24:51.291863918 CEST62910443192.168.2.4142.250.186.110
                                                      Oct 7, 2024 13:24:51.291908979 CEST44362910142.250.186.110192.168.2.4
                                                      Oct 7, 2024 13:24:51.372792006 CEST44362909142.250.186.110192.168.2.4
                                                      Oct 7, 2024 13:24:51.373131037 CEST44362909142.250.186.110192.168.2.4
                                                      Oct 7, 2024 13:24:51.373200893 CEST62909443192.168.2.4142.250.186.110
                                                      Oct 7, 2024 13:24:51.373684883 CEST62909443192.168.2.4142.250.186.110
                                                      Oct 7, 2024 13:24:51.373708010 CEST44362909142.250.186.110192.168.2.4

                                                      UDP Packets

                                                      TimestampSource PortDest PortSource IPDest IP
                                                      Oct 7, 2024 13:23:04.490978003 CEST53618431.1.1.1192.168.2.4
                                                      Oct 7, 2024 13:23:04.511553049 CEST4918853192.168.2.41.1.1.1
                                                      Oct 7, 2024 13:23:04.511794090 CEST5232753192.168.2.41.1.1.1
                                                      Oct 7, 2024 13:23:04.518644094 CEST53491881.1.1.1192.168.2.4
                                                      Oct 7, 2024 13:23:04.519665956 CEST53496081.1.1.1192.168.2.4
                                                      Oct 7, 2024 13:23:04.528271914 CEST53523271.1.1.1192.168.2.4
                                                      Oct 7, 2024 13:23:05.706773996 CEST6300053192.168.2.41.1.1.1
                                                      Oct 7, 2024 13:23:05.706896067 CEST5494053192.168.2.41.1.1.1
                                                      Oct 7, 2024 13:23:05.713967085 CEST53549401.1.1.1192.168.2.4
                                                      Oct 7, 2024 13:23:05.713977098 CEST53630001.1.1.1192.168.2.4
                                                      Oct 7, 2024 13:23:05.719521999 CEST53640021.1.1.1192.168.2.4
                                                      Oct 7, 2024 13:23:08.881088972 CEST6452553192.168.2.41.1.1.1
                                                      Oct 7, 2024 13:23:08.881247044 CEST4979253192.168.2.41.1.1.1
                                                      Oct 7, 2024 13:23:08.892936945 CEST53497921.1.1.1192.168.2.4
                                                      Oct 7, 2024 13:23:08.892950058 CEST53645251.1.1.1192.168.2.4
                                                      Oct 7, 2024 13:23:11.220211029 CEST53541081.1.1.1192.168.2.4
                                                      Oct 7, 2024 13:23:14.749054909 CEST6155753192.168.2.41.1.1.1
                                                      Oct 7, 2024 13:23:14.749171972 CEST6351253192.168.2.41.1.1.1
                                                      Oct 7, 2024 13:23:14.756349087 CEST53615571.1.1.1192.168.2.4
                                                      Oct 7, 2024 13:23:14.756369114 CEST53635121.1.1.1192.168.2.4
                                                      Oct 7, 2024 13:23:15.816301107 CEST5743553192.168.2.41.1.1.1
                                                      Oct 7, 2024 13:23:15.816466093 CEST5950253192.168.2.41.1.1.1
                                                      Oct 7, 2024 13:23:15.823663950 CEST53574351.1.1.1192.168.2.4
                                                      Oct 7, 2024 13:23:15.823678017 CEST53595021.1.1.1192.168.2.4
                                                      Oct 7, 2024 13:23:16.829144001 CEST53533251.1.1.1192.168.2.4
                                                      Oct 7, 2024 13:23:18.669130087 CEST138138192.168.2.4192.168.2.255
                                                      Oct 7, 2024 13:23:22.671767950 CEST53639011.1.1.1192.168.2.4
                                                      Oct 7, 2024 13:23:41.594727993 CEST53641861.1.1.1192.168.2.4
                                                      Oct 7, 2024 13:24:04.205929041 CEST53536141.1.1.1192.168.2.4
                                                      Oct 7, 2024 13:24:04.311774015 CEST53496201.1.1.1192.168.2.4
                                                      Oct 7, 2024 13:24:16.519414902 CEST53510811.1.1.1192.168.2.4
                                                      Oct 7, 2024 13:24:17.368278027 CEST6260453192.168.2.41.1.1.1
                                                      Oct 7, 2024 13:24:17.368480921 CEST6454653192.168.2.41.1.1.1
                                                      Oct 7, 2024 13:24:17.375216961 CEST53645461.1.1.1192.168.2.4
                                                      Oct 7, 2024 13:24:17.375715017 CEST53626041.1.1.1192.168.2.4
                                                      Oct 7, 2024 13:24:32.449207067 CEST53620971.1.1.1192.168.2.4
                                                      Oct 7, 2024 13:24:37.498275042 CEST53647531.1.1.1192.168.2.4

                                                      DNS Queries

                                                      TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                      Oct 7, 2024 13:23:04.511553049 CEST192.168.2.41.1.1.10xc212Standard query (0)youtube.comA (IP address)IN (0x0001)false
                                                      Oct 7, 2024 13:23:04.511794090 CEST192.168.2.41.1.1.10xd388Standard query (0)youtube.com65IN (0x0001)false
                                                      Oct 7, 2024 13:23:05.706773996 CEST192.168.2.41.1.1.10x3c31Standard query (0)www.youtube.comA (IP address)IN (0x0001)false
                                                      Oct 7, 2024 13:23:05.706896067 CEST192.168.2.41.1.1.10xdfa2Standard query (0)www.youtube.com65IN (0x0001)false
                                                      Oct 7, 2024 13:23:08.881088972 CEST192.168.2.41.1.1.10xc2e2Standard query (0)www.google.comA (IP address)IN (0x0001)false
                                                      Oct 7, 2024 13:23:08.881247044 CEST192.168.2.41.1.1.10xe42Standard query (0)www.google.com65IN (0x0001)false
                                                      Oct 7, 2024 13:23:14.749054909 CEST192.168.2.41.1.1.10x66d4Standard query (0)accounts.youtube.comA (IP address)IN (0x0001)false
                                                      Oct 7, 2024 13:23:14.749171972 CEST192.168.2.41.1.1.10xc588Standard query (0)accounts.youtube.com65IN (0x0001)false
                                                      Oct 7, 2024 13:23:15.816301107 CEST192.168.2.41.1.1.10x861aStandard query (0)play.google.comA (IP address)IN (0x0001)false
                                                      Oct 7, 2024 13:23:15.816466093 CEST192.168.2.41.1.1.10x6051Standard query (0)play.google.com65IN (0x0001)false
                                                      Oct 7, 2024 13:24:17.368278027 CEST192.168.2.41.1.1.10x67caStandard query (0)play.google.comA (IP address)IN (0x0001)false
                                                      Oct 7, 2024 13:24:17.368480921 CEST192.168.2.41.1.1.10x3f77Standard query (0)play.google.com65IN (0x0001)false

                                                      DNS Answers

                                                      TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                      Oct 7, 2024 13:23:04.518644094 CEST1.1.1.1192.168.2.40xc212No error (0)youtube.com172.217.16.142A (IP address)IN (0x0001)false
                                                      Oct 7, 2024 13:23:04.528271914 CEST1.1.1.1192.168.2.40xd388No error (0)youtube.com65IN (0x0001)false
                                                      Oct 7, 2024 13:23:05.713967085 CEST1.1.1.1192.168.2.40xdfa2No error (0)www.youtube.comyoutube-ui.l.google.comCNAME (Canonical name)IN (0x0001)false
                                                      Oct 7, 2024 13:23:05.713967085 CEST1.1.1.1192.168.2.40xdfa2No error (0)youtube-ui.l.google.com65IN (0x0001)false
                                                      Oct 7, 2024 13:23:05.713977098 CEST1.1.1.1192.168.2.40x3c31No error (0)www.youtube.comyoutube-ui.l.google.comCNAME (Canonical name)IN (0x0001)false
                                                      Oct 7, 2024 13:23:05.713977098 CEST1.1.1.1192.168.2.40x3c31No error (0)youtube-ui.l.google.com172.217.18.110A (IP address)IN (0x0001)false
                                                      Oct 7, 2024 13:23:05.713977098 CEST1.1.1.1192.168.2.40x3c31No error (0)youtube-ui.l.google.com142.250.185.206A (IP address)IN (0x0001)false
                                                      Oct 7, 2024 13:23:05.713977098 CEST1.1.1.1192.168.2.40x3c31No error (0)youtube-ui.l.google.com142.250.185.78A (IP address)IN (0x0001)false
                                                      Oct 7, 2024 13:23:05.713977098 CEST1.1.1.1192.168.2.40x3c31No error (0)youtube-ui.l.google.com142.250.74.206A (IP address)IN (0x0001)false
                                                      Oct 7, 2024 13:23:05.713977098 CEST1.1.1.1192.168.2.40x3c31No error (0)youtube-ui.l.google.com142.250.185.174A (IP address)IN (0x0001)false
                                                      Oct 7, 2024 13:23:05.713977098 CEST1.1.1.1192.168.2.40x3c31No error (0)youtube-ui.l.google.com142.250.185.142A (IP address)IN (0x0001)false
                                                      Oct 7, 2024 13:23:05.713977098 CEST1.1.1.1192.168.2.40x3c31No error (0)youtube-ui.l.google.com216.58.206.46A (IP address)IN (0x0001)false
                                                      Oct 7, 2024 13:23:05.713977098 CEST1.1.1.1192.168.2.40x3c31No error (0)youtube-ui.l.google.com216.58.212.142A (IP address)IN (0x0001)false
                                                      Oct 7, 2024 13:23:05.713977098 CEST1.1.1.1192.168.2.40x3c31No error (0)youtube-ui.l.google.com142.250.181.238A (IP address)IN (0x0001)false
                                                      Oct 7, 2024 13:23:05.713977098 CEST1.1.1.1192.168.2.40x3c31No error (0)youtube-ui.l.google.com142.250.184.238A (IP address)IN (0x0001)false
                                                      Oct 7, 2024 13:23:05.713977098 CEST1.1.1.1192.168.2.40x3c31No error (0)youtube-ui.l.google.com142.250.185.238A (IP address)IN (0x0001)false
                                                      Oct 7, 2024 13:23:05.713977098 CEST1.1.1.1192.168.2.40x3c31No error (0)youtube-ui.l.google.com142.250.186.78A (IP address)IN (0x0001)false
                                                      Oct 7, 2024 13:23:05.713977098 CEST1.1.1.1192.168.2.40x3c31No error (0)youtube-ui.l.google.com142.250.186.46A (IP address)IN (0x0001)false
                                                      Oct 7, 2024 13:23:05.713977098 CEST1.1.1.1192.168.2.40x3c31No error (0)youtube-ui.l.google.com142.250.185.110A (IP address)IN (0x0001)false
                                                      Oct 7, 2024 13:23:05.713977098 CEST1.1.1.1192.168.2.40x3c31No error (0)youtube-ui.l.google.com142.250.184.206A (IP address)IN (0x0001)false
                                                      Oct 7, 2024 13:23:05.713977098 CEST1.1.1.1192.168.2.40x3c31No error (0)youtube-ui.l.google.com216.58.212.174A (IP address)IN (0x0001)false
                                                      Oct 7, 2024 13:23:08.892936945 CEST1.1.1.1192.168.2.40xe42No error (0)www.google.com65IN (0x0001)false
                                                      Oct 7, 2024 13:23:08.892950058 CEST1.1.1.1192.168.2.40xc2e2No error (0)www.google.com142.250.185.68A (IP address)IN (0x0001)false
                                                      Oct 7, 2024 13:23:14.756349087 CEST1.1.1.1192.168.2.40x66d4No error (0)accounts.youtube.comwww3.l.google.comCNAME (Canonical name)IN (0x0001)false
                                                      Oct 7, 2024 13:23:14.756349087 CEST1.1.1.1192.168.2.40x66d4No error (0)www3.l.google.com216.58.206.46A (IP address)IN (0x0001)false
                                                      Oct 7, 2024 13:23:14.756369114 CEST1.1.1.1192.168.2.40xc588No error (0)accounts.youtube.comwww3.l.google.comCNAME (Canonical name)IN (0x0001)false
                                                      Oct 7, 2024 13:23:15.823663950 CEST1.1.1.1192.168.2.40x861aNo error (0)play.google.com142.250.181.238A (IP address)IN (0x0001)false
                                                      Oct 7, 2024 13:24:17.375715017 CEST1.1.1.1192.168.2.40x67caNo error (0)play.google.com142.250.186.110A (IP address)IN (0x0001)false

                                                      HTTP Request Dependency Graph

                                                      • youtube.com
                                                      • www.youtube.com
                                                      • fs.microsoft.com
                                                      • https:
                                                        • accounts.youtube.com
                                                        • www.google.com
                                                        • play.google.com
                                                      • slscr.update.microsoft.com
                                                      • otelrules.azureedge.net

                                                      HTTPS Proxied Packets

                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                      0192.168.2.449733172.217.16.1424437832C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:23:05 UTC851OUTGET /account?=https://accounts.google.com/v3/signin/challenge/pwd HTTP/1.1
                                                      Host: youtube.com
                                                      Connection: keep-alive
                                                      sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                                      sec-ch-ua-mobile: ?0
                                                      sec-ch-ua-platform: "Windows"
                                                      Upgrade-Insecure-Requests: 1
                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                                      X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX
                                                      Sec-Fetch-Site: none
                                                      Sec-Fetch-Mode: navigate
                                                      Sec-Fetch-User: ?1
                                                      Sec-Fetch-Dest: document
                                                      Accept-Encoding: gzip, deflate, br
                                                      Accept-Language: en-US,en;q=0.9
                                                      2024-10-07 11:23:05 UTC1704INHTTP/1.1 301 Moved Permanently
                                                      Content-Type: application/binary
                                                      X-Content-Type-Options: nosniff
                                                      Expires: Mon, 07 Oct 2024 11:23:05 GMT
                                                      Date: Mon, 07 Oct 2024 11:23:05 GMT
                                                      Cache-Control: private, max-age=31536000
                                                      Location: https://www.youtube.com/account?=https%3A%2F%2Faccounts.google.com%2Fv3%2Fsignin%2Fchallenge%2Fpwd
                                                      Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                      X-Frame-Options: SAMEORIGIN
                                                      Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                                      Vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                                      Content-Security-Policy: require-trusted-types-for 'script'
                                                      Origin-Trial: AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9
                                                      Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="youtube_main"
                                                      Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
                                                      Report-To: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
                                                      Server: ESF
                                                      Content-Length: 0
                                                      X-XSS-Protection: 0
                                                      Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                      Connection: close


                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                      1192.168.2.449736172.217.18.1104437832C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:23:06 UTC869OUTGET /account?=https%3A%2F%2Faccounts.google.com%2Fv3%2Fsignin%2Fchallenge%2Fpwd HTTP/1.1
                                                      Host: www.youtube.com
                                                      Connection: keep-alive
                                                      Upgrade-Insecure-Requests: 1
                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                                      X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX
                                                      Sec-Fetch-Site: none
                                                      Sec-Fetch-Mode: navigate
                                                      Sec-Fetch-User: ?1
                                                      Sec-Fetch-Dest: document
                                                      sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                                      sec-ch-ua-mobile: ?0
                                                      sec-ch-ua-platform: "Windows"
                                                      Accept-Encoding: gzip, deflate, br
                                                      Accept-Language: en-US,en;q=0.9
                                                      2024-10-07 11:23:06 UTC2634INHTTP/1.1 303 See Other
                                                      Content-Type: application/binary
                                                      X-Content-Type-Options: nosniff
                                                      Cache-Control: no-cache, no-store, max-age=0, must-revalidate
                                                      Pragma: no-cache
                                                      Expires: Mon, 01 Jan 1990 00:00:00 GMT
                                                      Date: Mon, 07 Oct 2024 11:23:06 GMT
                                                      Location: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%253F%253Dhttps%25253A%25252F%25252Faccounts.google.com%25252Fv3%25252Fsignin%25252Fchallenge%25252Fpwd%26feature%3Dredirect_login&hl=en
                                                      Strict-Transport-Security: max-age=31536000
                                                      X-Frame-Options: SAMEORIGIN
                                                      Report-To: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
                                                      Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
                                                      Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                                      Vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                                      Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="youtube_main"
                                                      Content-Security-Policy: require-trusted-types-for 'script'
                                                      Origin-Trial: AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9
                                                      P3P: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
                                                      Server: ESF
                                                      Content-Length: 0
                                                      X-XSS-Protection: 0
                                                      Set-Cookie: GPS=1; Domain=.youtube.com; Expires=Mon, 07-Oct-2024 11:53:06 GMT; Path=/; Secure; HttpOnly
                                                      Set-Cookie: YSC=YiOm4y6Te4w; Domain=.youtube.com; Path=/; Secure; HttpOnly; SameSite=none; Partitioned
                                                      Set-Cookie: VISITOR_INFO1_LIVE=OU2QjVRJuBc; Domain=.youtube.com; Expires=Sat, 05-Apr-2025 11:23:06 GMT; Path=/; Secure; HttpOnly; SameSite=none; Partitioned
                                                      Set-Cookie: VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgOQ%3D%3D; Domain=.youtube.com; Expires=Sat, 05-Apr-2025 11:23:06 GMT; Path=/; Secure; HttpOnly; SameSite=none; Partitioned
                                                      Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                      Connection: close


                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                      2192.168.2.449742184.28.90.27443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:23:10 UTC161OUTHEAD /fs/windows/config.json HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept: */*
                                                      Accept-Encoding: identity
                                                      User-Agent: Microsoft BITS/7.8
                                                      Host: fs.microsoft.com
                                                      2024-10-07 11:23:10 UTC467INHTTP/1.1 200 OK
                                                      Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json
                                                      Content-Type: application/octet-stream
                                                      ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7"
                                                      Last-Modified: Tue, 16 May 2017 22:58:00 GMT
                                                      Server: ECAcc (lpl/EF45)
                                                      X-CID: 11
                                                      X-Ms-ApiVersion: Distribute 1.2
                                                      X-Ms-Region: prod-weu-z1
                                                      Cache-Control: public, max-age=192152
                                                      Date: Mon, 07 Oct 2024 11:23:10 GMT
                                                      Connection: close
                                                      X-CID: 2


                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                      3192.168.2.449745184.28.90.27443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:23:11 UTC239OUTGET /fs/windows/config.json HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept: */*
                                                      Accept-Encoding: identity
                                                      If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT
                                                      Range: bytes=0-2147483646
                                                      User-Agent: Microsoft BITS/7.8
                                                      Host: fs.microsoft.com
                                                      2024-10-07 11:23:11 UTC515INHTTP/1.1 200 OK
                                                      ApiVersion: Distribute 1.1
                                                      Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json
                                                      Content-Type: application/octet-stream
                                                      ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7"
                                                      Last-Modified: Tue, 16 May 2017 22:58:00 GMT
                                                      Server: ECAcc (lpl/EF06)
                                                      X-CID: 11
                                                      X-Ms-ApiVersion: Distribute 1.2
                                                      X-Ms-Region: prod-weu-z1
                                                      Cache-Control: public, max-age=192087
                                                      Date: Mon, 07 Oct 2024 11:23:11 GMT
                                                      Content-Length: 55
                                                      Connection: close
                                                      X-CID: 2
                                                      2024-10-07 11:23:11 UTC55INData Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d
                                                      Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}


                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                      4192.168.2.449757216.58.206.464437832C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:23:15 UTC1236OUTGET /accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=-528144849&timestamp=1728300193684 HTTP/1.1
                                                      Host: accounts.youtube.com
                                                      Connection: keep-alive
                                                      sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                                      sec-ch-ua-mobile: ?0
                                                      sec-ch-ua-full-version: "117.0.5938.132"
                                                      sec-ch-ua-arch: "x86"
                                                      sec-ch-ua-platform: "Windows"
                                                      sec-ch-ua-platform-version: "10.0.0"
                                                      sec-ch-ua-model: ""
                                                      sec-ch-ua-bitness: "64"
                                                      sec-ch-ua-wow64: ?0
                                                      sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"
                                                      Upgrade-Insecure-Requests: 1
                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                                      X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX
                                                      Sec-Fetch-Site: cross-site
                                                      Sec-Fetch-Mode: navigate
                                                      Sec-Fetch-User: ?1
                                                      Sec-Fetch-Dest: iframe
                                                      Referer: https://accounts.google.com/
                                                      Accept-Encoding: gzip, deflate, br
                                                      Accept-Language: en-US,en;q=0.9
                                                      2024-10-07 11:23:15 UTC1969INHTTP/1.1 200 OK
                                                      Content-Type: text/html; charset=utf-8
                                                      X-Frame-Options: ALLOW-FROM https://accounts.google.com
                                                      Content-Security-Policy: frame-ancestors https://accounts.google.com
                                                      Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport
                                                      Content-Security-Policy: script-src 'report-sample' 'nonce-3dP3yVugZ18Y3uFwmKB8IA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport;worker-src 'self'
                                                      Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport/allowlist
                                                      Cache-Control: no-cache, no-store, max-age=0, must-revalidate
                                                      Pragma: no-cache
                                                      Expires: Mon, 01 Jan 1990 00:00:00 GMT
                                                      Date: Mon, 07 Oct 2024 11:23:15 GMT
                                                      Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                                      Cross-Origin-Opener-Policy: same-origin
                                                      Cross-Origin-Resource-Policy: cross-origin
                                                      Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
                                                      reporting-endpoints: default="/_/AccountsDomainCookiesCheckConnectionHttp/web-reports?context=eJzjstDikmII0pBikPj6kkkDiJ3SZ7AGAXHSv_OsRUB8ufsS63UgVu25xGoKxEUSV1ibgFiIh2NxZ_8ONoEXD3_OZlLSS8ovjM9MSc0rySypTMnPTczMS87Pz85MLS5OLSpLLYo3MjAyMbA0stQzsIgvMAAA4O4tkg"
                                                      Server: ESF
                                                      X-XSS-Protection: 0
                                                      X-Content-Type-Options: nosniff
                                                      Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                      Accept-Ranges: none
                                                      Vary: Accept-Encoding
                                                      Connection: close
                                                      Transfer-Encoding: chunked
                                                      2024-10-07 11:23:15 UTC1969INData Raw: 37 36 31 35 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 33 64 50 33 79 56 75 67 5a 31 38 59 33 75 46 77 6d 4b 42 38 49 41 22 3e 22 75 73 65 20 73 74 72 69 63 74 22 3b 74 68 69 73 2e 64 65 66 61 75 6c 74 5f 41 63 63 6f 75 6e 74 73 44 6f 6d 61 69 6e 63 6f 6f 6b 69 65 73 43 68 65 63 6b 63 6f 6e 6e 65 63 74 69 6f 6e 4a 73 3d 74 68 69 73 2e 64 65 66 61 75 6c 74 5f 41 63 63 6f 75 6e 74 73 44 6f 6d 61 69 6e 63 6f 6f 6b 69 65 73 43 68 65 63 6b 63 6f 6e 6e 65 63 74 69 6f 6e 4a 73 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 74 72 79 7b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f
                                                      Data Ascii: 7615<html><head><script nonce="3dP3yVugZ18Y3uFwmKB8IA">"use strict";this.default_AccountsDomaincookiesCheckconnectionJs=this.default_AccountsDomaincookiesCheckconnectionJs||{};(function(_){var window=this;try{_._F_toggles_initialize=function(a){(typeo
                                                      2024-10-07 11:23:15 UTC1969INData Raw: 54 72 69 64 65 6e 74 5c 2f 28 5c 64 2e 5c 64 29 2f 2e 65 78 65 63 28 62 29 2c 0a 63 5b 31 5d 3d 3d 22 37 2e 30 22 29 69 66 28 62 26 26 62 5b 31 5d 29 73 77 69 74 63 68 28 62 5b 31 5d 29 7b 63 61 73 65 20 22 34 2e 30 22 3a 61 3d 22 38 2e 30 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 35 2e 30 22 3a 61 3d 22 39 2e 30 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 36 2e 30 22 3a 61 3d 22 31 30 2e 30 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 37 2e 30 22 3a 61 3d 22 31 31 2e 30 22 7d 65 6c 73 65 20 61 3d 22 37 2e 30 22 3b 65 6c 73 65 20 61 3d 63 5b 31 5d 3b 62 3d 61 7d 65 6c 73 65 20 62 3d 22 22 3b 72 65 74 75 72 6e 20 62 7d 76 61 72 20 64 3d 52 65 67 45 78 70 28 22 28 5b 41 2d 5a 5d 5b 5c 5c 77 20 5d 2b 29 2f 28 5b 5e 5c 5c 73 5d 2b 29 5c 5c 73 2a 28 3f 3a 5c 5c 28
                                                      Data Ascii: Trident\/(\d.\d)/.exec(b),c[1]=="7.0")if(b&&b[1])switch(b[1]){case "4.0":a="8.0";break;case "5.0":a="9.0";break;case "6.0":a="10.0";break;case "7.0":a="11.0"}else a="7.0";else a=c[1];b=a}else b="";return b}var d=RegExp("([A-Z][\\w ]+)/([^\\s]+)\\s*(?:\\(
                                                      2024-10-07 11:23:15 UTC1969INData Raw: 74 63 68 28 74 79 70 65 6f 66 20 61 29 7b 63 61 73 65 20 22 6e 75 6d 62 65 72 22 3a 72 65 74 75 72 6e 20 69 73 46 69 6e 69 74 65 28 61 29 3f 61 3a 53 74 72 69 6e 67 28 61 29 3b 63 61 73 65 20 22 62 69 67 69 6e 74 22 3a 72 65 74 75 72 6e 28 41 61 3f 0a 61 3e 3d 42 61 26 26 61 3c 3d 43 61 3a 61 5b 30 5d 3d 3d 3d 22 2d 22 3f 75 61 28 61 2c 44 61 29 3a 75 61 28 61 2c 45 61 29 29 3f 4e 75 6d 62 65 72 28 61 29 3a 53 74 72 69 6e 67 28 61 29 3b 63 61 73 65 20 22 62 6f 6f 6c 65 61 6e 22 3a 72 65 74 75 72 6e 20 61 3f 31 3a 30 3b 63 61 73 65 20 22 6f 62 6a 65 63 74 22 3a 69 66 28 61 29 69 66 28 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 61 29 29 7b 69 66 28 43 28 61 29 29 72 65 74 75 72 6e 7d 65 6c 73 65 20 69 66 28 46 61 26 26 61 21 3d 6e 75 6c 6c 26 26 61 20 69 6e
                                                      Data Ascii: tch(typeof a){case "number":return isFinite(a)?a:String(a);case "bigint":return(Aa?a>=Ba&&a<=Ca:a[0]==="-"?ua(a,Da):ua(a,Ea))?Number(a):String(a);case "boolean":return a?1:0;case "object":if(a)if(Array.isArray(a)){if(C(a))return}else if(Fa&&a!=null&&a in
                                                      2024-10-07 11:23:15 UTC1969INData Raw: 7b 76 61 72 20 62 3b 69 66 28 61 26 26 28 62 3d 51 61 29 21 3d 6e 75 6c 6c 26 26 62 2e 68 61 73 28 61 29 26 26 28 62 3d 61 2e 43 29 29 66 6f 72 28 76 61 72 20 63 3d 30 3b 63 3c 62 2e 6c 65 6e 67 74 68 3b 63 2b 2b 29 7b 76 61 72 20 64 3d 62 5b 63 5d 3b 69 66 28 63 3d 3d 3d 62 2e 6c 65 6e 67 74 68 2d 31 26 26 41 28 64 29 29 66 6f 72 28 76 61 72 20 65 20 69 6e 20 64 29 7b 76 61 72 20 66 3d 64 5b 65 5d 3b 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 66 29 26 26 0a 52 61 28 66 2c 61 29 7d 65 6c 73 65 20 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 64 29 26 26 52 61 28 64 2c 61 29 7d 61 3d 45 3f 61 2e 43 3a 4d 61 28 61 2e 43 2c 50 61 2c 76 6f 69 64 20 30 2c 76 6f 69 64 20 30 2c 21 31 29 3b 65 3d 21 45 3b 69 66 28 62 3d 61 2e 6c 65 6e 67 74 68 29 7b 64 3d 61 5b 62 2d
                                                      Data Ascii: {var b;if(a&&(b=Qa)!=null&&b.has(a)&&(b=a.C))for(var c=0;c<b.length;c++){var d=b[c];if(c===b.length-1&&A(d))for(var e in d){var f=d[e];Array.isArray(f)&&Ra(f,a)}else Array.isArray(d)&&Ra(d,a)}a=E?a.C:Ma(a.C,Pa,void 0,void 0,!1);e=!E;if(b=a.length){d=a[b-
                                                      2024-10-07 11:23:15 UTC1969INData Raw: 6f 6c 2e 69 74 65 72 61 74 6f 72 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 29 72 65 74 75 72 6e 20 61 3b 61 3d 53 79 6d 62 6f 6c 28 22 63 22 29 3b 66 6f 72 28 76 61 72 20 62 3d 22 41 72 72 61 79 20 49 6e 74 38 41 72 72 61 79 20 55 69 6e 74 38 41 72 72 61 79 20 55 69 6e 74 38 43 6c 61 6d 70 65 64 41 72 72 61 79 20 49 6e 74 31 36 41 72 72 61 79 20 55 69 6e 74 31 36 41 72 72 61 79 20 49 6e 74 33 32 41 72 72 61 79 20 55 69 6e 74 33 32 41 72 72 61 79 20 46 6c 6f 61 74 33 32 41 72 72 61 79 20 46 6c 6f 61 74 36 34 41 72 72 61 79 22 2e 73 70 6c 69 74 28 22 20 22 29 2c 63 3d 30 3b 63 3c 62 2e 6c 65 6e 67 74 68 3b 63 2b 2b 29 7b 76 61 72 20 64 3d 57 61 5b 62 5b 63 5d 5d 3b 74 79 70 65 6f 66 20 64 3d 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 26 26 74 79 70 65
                                                      Data Ascii: ol.iterator",function(a){if(a)return a;a=Symbol("c");for(var b="Array Int8Array Uint8Array Uint8ClampedArray Int16Array Uint16Array Int32Array Uint32Array Float32Array Float64Array".split(" "),c=0;c<b.length;c++){var d=Wa[b[c]];typeof d==="function"&&type
                                                      2024-10-07 11:23:15 UTC1969INData Raw: 29 3b 65 28 22 66 72 65 65 7a 65 22 29 3b 65 28 22 70 72 65 76 65 6e 74 45 78 74 65 6e 73 69 6f 6e 73 22 29 3b 65 28 22 73 65 61 6c 22 29 3b 76 61 72 20 68 3d 30 2c 67 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 74 68 69 73 2e 67 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6b 29 7b 6b 3d 48 28 6b 29 3b 66 6f 72 28 76 61 72 20 6c 3b 21 28 6c 3d 6b 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6c 3d 6c 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6c 5b 30 5d 2c 6c 5b 31 5d 29 7d 7d 3b 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6b 2c 6c 29 7b 69 66 28 21 63 28 6b 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 69 22 29 3b 64 28 6b 29 3b 69 66 28 21 49 28 6b 2c 66 29 29
                                                      Data Ascii: );e("freeze");e("preventExtensions");e("seal");var h=0,g=function(k){this.g=(h+=Math.random()+1).toString();if(k){k=H(k);for(var l;!(l=k.next()).done;)l=l.value,this.set(l[0],l[1])}};g.prototype.set=function(k,l){if(!c(k))throw Error("i");d(k);if(!I(k,f))
                                                      2024-10-07 11:23:15 UTC1969INData Raw: 75 72 6e 20 67 2e 76 61 6c 75 65 7d 29 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 66 6f 72 45 61 63 68 3d 66 75 6e 63 74 69 6f 6e 28 67 2c 6b 29 7b 66 6f 72 28 76 61 72 20 6c 3d 74 68 69 73 2e 65 6e 74 72 69 65 73 28 29 2c 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 0a 6d 2e 76 61 6c 75 65 2c 67 2e 63 61 6c 6c 28 6b 2c 6d 5b 31 5d 2c 6d 5b 30 5d 2c 74 68 69 73 29 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3d 63 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 74 72 69 65 73 3b 76 61 72 20 64 3d 66 75 6e 63 74 69 6f 6e 28 67 2c 6b 29 7b 76 61 72 20 6c 3d 6b 26 26 74 79 70 65 6f 66 20 6b 3b 6c 3d 3d 22 6f 62 6a 65 63 74 22 7c 7c 6c 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 3f 62 2e 68 61 73 28 6b 29
                                                      Data Ascii: urn g.value})};c.prototype.forEach=function(g,k){for(var l=this.entries(),m;!(m=l.next()).done;)m=m.value,g.call(k,m[1],m[0],this)};c.prototype[Symbol.iterator]=c.prototype.entries;var d=function(g,k){var l=k&&typeof k;l=="object"||l=="function"?b.has(k)
                                                      2024-10-07 11:23:15 UTC1969INData Raw: 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 20 74 79 70 65 6f 66 20 62 3d 3d 3d 22 6e 75 6d 62 65 72 22 26 26 69 73 4e 61 4e 28 62 29 7d 7d 29 3b 76 61 72 20 66 62 3d 66 62 7c 7c 7b 7d 2c 71 3d 74 68 69 73 7c 7c 73 65 6c 66 2c 67 62 3d 71 2e 5f 46 5f 74 6f 67 67 6c 65 73 7c 7c 5b 5d 2c 68 62 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 61 2e 73 70 6c 69 74 28 22 2e 22 29 3b 66 6f 72 28 76 61 72 20 62 3d 71 2c 63 3d 30 3b 63 3c 61 2e 6c 65 6e 67 74 68 3b 63 2b 2b 29 69 66 28 62 3d 62 5b 61 5b 63 5d 5d 2c 62 3d 3d 6e 75 6c 6c 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 72 65 74 75 72 6e 20 62 7d 2c 69 62 3d 22 63 6c 6f 73 75 72 65 5f 75 69 64 5f 22 2b 28 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2a 31 45
                                                      Data Ascii: on(a){return a?a:function(b){return typeof b==="number"&&isNaN(b)}});var fb=fb||{},q=this||self,gb=q._F_toggles||[],hb=function(a){a=a.split(".");for(var b=q,c=0;c<a.length;c++)if(b=b[a[c]],b==null)return null;return b},ib="closure_uid_"+(Math.random()*1E
                                                      2024-10-07 11:23:15 UTC1969INData Raw: 74 65 78 74 5f 5f 39 38 34 33 38 32 3d 7b 7d 29 3b 61 2e 5f 5f 63 6c 6f 73 75 72 65 5f 5f 65 72 72 6f 72 5f 5f 63 6f 6e 74 65 78 74 5f 5f 39 38 34 33 38 32 2e 73 65 76 65 72 69 74 79 3d 62 7d 3b 76 61 72 20 71 62 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 63 3d 63 7c 7c 71 3b 76 61 72 20 64 3d 63 2e 6f 6e 65 72 72 6f 72 2c 65 3d 21 21 62 3b 63 2e 6f 6e 65 72 72 6f 72 3d 66 75 6e 63 74 69 6f 6e 28 66 2c 68 2c 67 2c 6b 2c 6c 29 7b 64 26 26 64 28 66 2c 68 2c 67 2c 6b 2c 6c 29 3b 61 28 7b 6d 65 73 73 61 67 65 3a 66 2c 66 69 6c 65 4e 61 6d 65 3a 68 2c 6c 69 6e 65 3a 67 2c 6c 69 6e 65 4e 75 6d 62 65 72 3a 67 2c 62 61 3a 6b 2c 65 72 72 6f 72 3a 6c 7d 29 3b 72 65 74 75 72 6e 20 65 7d 7d 2c 74 62 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 68
                                                      Data Ascii: text__984382={});a.__closure__error__context__984382.severity=b};var qb=function(a,b,c){c=c||q;var d=c.onerror,e=!!b;c.onerror=function(f,h,g,k,l){d&&d(f,h,g,k,l);a({message:f,fileName:h,line:g,lineNumber:g,ba:k,error:l});return e}},tb=function(a){var b=h
                                                      2024-10-07 11:23:15 UTC1969INData Raw: 22 6e 75 6d 62 65 72 22 3a 66 3d 53 74 72 69 6e 67 28 66 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 62 6f 6f 6c 65 61 6e 22 3a 66 3d 66 3f 22 74 72 75 65 22 3a 22 66 61 6c 73 65 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 66 75 6e 63 74 69 6f 6e 22 3a 66 3d 28 66 3d 73 62 28 66 29 29 3f 66 3a 22 5b 66 6e 5d 22 3b 62 72 65 61 6b 3b 64 65 66 61 75 6c 74 3a 66 3d 0a 74 79 70 65 6f 66 20 66 7d 66 2e 6c 65 6e 67 74 68 3e 34 30 26 26 28 66 3d 66 2e 73 6c 69 63 65 28 30 2c 34 30 29 2b 22 2e 2e 2e 22 29 3b 63 2e 70 75 73 68 28 66 29 7d 62 2e 70 75 73 68 28 61 29 3b 63 2e 70 75 73 68 28 22 29 5c 6e 22 29 3b 74 72 79 7b 63 2e 70 75 73 68 28 77 62 28 61 2e 63 61 6c 6c 65 72 2c 62 29 29 7d 63 61 74 63 68 28 68 29 7b 63 2e 70 75 73 68 28 22 5b 65 78 63 65 70 74 69 6f 6e
                                                      Data Ascii: "number":f=String(f);break;case "boolean":f=f?"true":"false";break;case "function":f=(f=sb(f))?f:"[fn]";break;default:f=typeof f}f.length>40&&(f=f.slice(0,40)+"...");c.push(f)}b.push(a);c.push(")\n");try{c.push(wb(a.caller,b))}catch(h){c.push("[exception


                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                      5192.168.2.449741142.250.185.684437832C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:23:18 UTC1017OUTGET /favicon.ico HTTP/1.1
                                                      Host: www.google.com
                                                      Connection: keep-alive
                                                      sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                                      sec-ch-ua-mobile: ?0
                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                      sec-ch-ua-arch: "x86"
                                                      sec-ch-ua-full-version: "117.0.5938.132"
                                                      sec-ch-ua-platform-version: "10.0.0"
                                                      sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"
                                                      sec-ch-ua-bitness: "64"
                                                      sec-ch-ua-model: ""
                                                      sec-ch-ua-wow64: ?0
                                                      sec-ch-ua-platform: "Windows"
                                                      Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                                                      X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX
                                                      Sec-Fetch-Site: same-site
                                                      Sec-Fetch-Mode: no-cors
                                                      Sec-Fetch-Dest: image
                                                      Referer: https://accounts.google.com/
                                                      Accept-Encoding: gzip, deflate, br
                                                      Accept-Language: en-US,en;q=0.9
                                                      2024-10-07 11:23:18 UTC705INHTTP/1.1 200 OK
                                                      Accept-Ranges: bytes
                                                      Cross-Origin-Resource-Policy: cross-origin
                                                      Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable"
                                                      Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
                                                      Content-Length: 5430
                                                      X-Content-Type-Options: nosniff
                                                      Server: sffe
                                                      X-XSS-Protection: 0
                                                      Date: Mon, 07 Oct 2024 10:09:04 GMT
                                                      Expires: Tue, 15 Oct 2024 10:09:04 GMT
                                                      Cache-Control: public, max-age=691200
                                                      Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT
                                                      Content-Type: image/x-icon
                                                      Vary: Accept-Encoding
                                                      Age: 4454
                                                      Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                      Connection: close
                                                      2024-10-07 11:23:18 UTC685INData Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 fd fd fd 96 fd fd fd d8 fd fd fd f9 fd fd fd f9 fd fd fd d7 fd fd fd 94 fe fe fe 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd 99 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 95 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd c1 ff ff ff ff fa fd f9 ff b4 d9 a7 ff 76 ba 5d ff 58 ab 3a ff 58 aa 3a ff 72 b8 59 ff ac d5 9d ff f8 fb f6 ff ff
                                                      Data Ascii: h& ( 0.v]X:X:rY
                                                      2024-10-07 11:23:18 UTC1390INData Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d8 fd fd fd 99 ff ff ff ff 92 cf fb ff 37 52 ec ff 38 46 ea ff d0 d4 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 96 fe fe fe 32 ff ff ff ff f9 f9 fe ff 56 62 ed ff 35 43 ea ff 3b 49 eb ff 95 9c f4 ff cf d2 fa ff d1 d4 fa ff 96 9d f4 ff 52 5e ed ff e1 e3 fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 30 00 00 00 00 fd fd fd 9d ff ff ff ff e8 ea fd ff 58 63 ee ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 6c 76 f0 ff ff ff ff ff ff ff ff ff fd fd fd 98 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd c3 ff ff ff ff f9 f9 fe ff a5 ac f6 ff 5d 69 ee ff 3c 4a
                                                      Data Ascii: 7R8F2Vb5C;IR^0Xc5C5C5C5C5C5Clv]i<J
                                                      2024-10-07 11:23:18 UTC1390INData Raw: ff ff ff ff ff ff ff ff ff ff ff fd fd fd d0 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fd fd fd 8b ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b1 d8 a3 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 60 a5 35 ff ca 8e 3e ff f9 c1 9f ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 87 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 25 fd fd fd fb ff ff ff ff ff ff ff ff ff ff ff ff c2 e0 b7 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 6e b6 54 ff 9f ce 8d ff b7 da aa ff b8 db ab ff a5 d2 95 ff 7b bc 64 ff 54 a8 35 ff 53 a8 34 ff 77 a0 37 ff e3 89 41 ff f4 85 42 ff f4 85 42 ff
                                                      Data Ascii: S4S4S4S4S4S4S4S4S4S4S4S4S4S4`5>%S4S4S4S4S4S4nT{dT5S4w7ABB
                                                      2024-10-07 11:23:18 UTC1390INData Raw: ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff fb d5 bf ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd ea fd fd fd cb ff ff ff ff ff ff ff ff ff ff ff ff 46 cd fc ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 21 ae f9 ff fb fb ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd c8 fd fd fd 9c ff ff ff ff ff ff ff ff ff ff ff ff 86 df fd ff 05 bc fb ff 05 bc fb ff 15 93 f5 ff 34 49 eb ff b3 b8 f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                                      Data Ascii: BBBBBBF!4I
                                                      2024-10-07 11:23:18 UTC575INData Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d2 fe fe fe 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd 8d fd fd fd fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd fb fd fd fd 8b fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 27 fd fd fd 9f fd fd fd f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                                      Data Ascii: $'


                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                      6192.168.2.4497694.175.87.197443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:23:19 UTC306OUTGET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=VHV8A9Yd+22nUsD&MD=9zWC1dr4 HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept: */*
                                                      User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33
                                                      Host: slscr.update.microsoft.com
                                                      2024-10-07 11:23:19 UTC560INHTTP/1.1 200 OK
                                                      Cache-Control: no-cache
                                                      Pragma: no-cache
                                                      Content-Type: application/octet-stream
                                                      Expires: -1
                                                      Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT
                                                      ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880"
                                                      MS-CorrelationId: 3f4d6b05-ebbb-4e34-a2c2-c697424ab6ed
                                                      MS-RequestId: c7b9924d-f18d-46eb-8baa-85374bd10cfe
                                                      MS-CV: Rl0S14NTaUayMBKN.0
                                                      X-Microsoft-SLSClientCache: 2880
                                                      Content-Disposition: attachment; filename=environment.cab
                                                      X-Content-Type-Options: nosniff
                                                      Date: Mon, 07 Oct 2024 11:23:19 GMT
                                                      Connection: close
                                                      Content-Length: 24490
                                                      2024-10-07 11:23:19 UTC15824INData Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58
                                                      Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
                                                      2024-10-07 11:23:19 UTC8666INData Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31
                                                      Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      7192.168.2.44978413.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:23:55 UTC195OUTGET /rules/other-Win32-v19.bundle HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:23:55 UTC540INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:23:55 GMT
                                                      Content-Type: text/plain
                                                      Content-Length: 218853
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public
                                                      Last-Modified: Fri, 04 Oct 2024 23:21:50 GMT
                                                      ETag: "0x8DCE4CB535A72FA"
                                                      x-ms-request-id: 4dad204e-401e-005b-4bf5-169c0c000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112355Z-1657d5bbd48jwrqbupe3ktsx9w00000003fg00000000gtd2
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:23:55 UTC15844INData Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20
                                                      Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
                                                      2024-10-07 11:23:55 UTC16384INData Raw: 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e
                                                      Data Ascii: "0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" />
                                                      2024-10-07 11:23:55 UTC16384INData Raw: 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31
                                                      Data Ascii: <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-781
                                                      2024-10-07 11:23:55 UTC16384INData Raw: 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20
                                                      Data Ascii: T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32"
                                                      2024-10-07 11:23:55 UTC16384INData Raw: 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f
                                                      Data Ascii: "0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Co
                                                      2024-10-07 11:23:55 UTC16384INData Raw: 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a
                                                      Data Ascii: <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C>
                                                      2024-10-07 11:23:55 UTC16384INData Raw: 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63
                                                      Data Ascii: <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMillisec
                                                      2024-10-07 11:23:55 UTC16384INData Raw: 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e
                                                      Data Ascii: R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIn
                                                      2024-10-07 11:23:55 UTC16384INData Raw: 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20
                                                      Data Ascii: R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L>
                                                      2024-10-07 11:23:55 UTC16384INData Raw: 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c
                                                      Data Ascii: T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      8192.168.2.44978513.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:23:56 UTC192OUTGET /rules/rule224902v2s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:23:56 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:23:56 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 450
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT
                                                      ETag: "0x8DC582BD4C869AE"
                                                      x-ms-request-id: d4448e94-101e-00a2-2703-179f2e000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112356Z-1657d5bbd48vlsxxpe15ac3q7n00000003ag00000000c327
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:23:56 UTC450INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      9192.168.2.44978713.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:23:56 UTC192OUTGET /rules/rule120600v4s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:23:56 UTC563INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:23:56 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 2980
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT
                                                      ETag: "0x8DC582BA80D96A1"
                                                      x-ms-request-id: 8aaf7b13-d01e-0028-46fd-167896000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112356Z-1657d5bbd482krtfgrg72dfbtn000000038g000000000vdc
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:23:56 UTC2980INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      10192.168.2.44978613.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:23:56 UTC193OUTGET /rules/rule120402v21s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:23:56 UTC563INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:23:56 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 3788
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT
                                                      ETag: "0x8DC582BAC2126A6"
                                                      x-ms-request-id: 4545068c-701e-0050-0e05-176767000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112356Z-1657d5bbd48lknvp09v995n79000000002x000000000gp40
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:23:56 UTC3788INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      11192.168.2.44978813.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:23:56 UTC192OUTGET /rules/rule120608v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:23:56 UTC563INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:23:56 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 2160
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT
                                                      ETag: "0x8DC582BA3B95D81"
                                                      x-ms-request-id: c62b5fc1-401e-0067-3a60-1709c2000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112356Z-1657d5bbd48dfrdj7px744zp8s000000034000000000amsc
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:23:56 UTC2160INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      12192.168.2.44979013.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:23:57 UTC192OUTGET /rules/rule120610v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:23:57 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:23:57 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 474
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT
                                                      ETag: "0x8DC582B9964B277"
                                                      x-ms-request-id: 3ea0840d-701e-0053-1012-173a0a000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112357Z-1657d5bbd48tnj6wmberkg2xy800000003dg00000000cxsd
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:23:57 UTC474INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      13192.168.2.44979113.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:23:57 UTC192OUTGET /rules/rule120611v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:23:57 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:23:57 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 415
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT
                                                      ETag: "0x8DC582B9F6F3512"
                                                      x-ms-request-id: 1707b783-801e-00a3-53e5-167cfb000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112357Z-1657d5bbd48cpbzgkvtewk0wu000000003eg00000000b8sc
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:23:57 UTC415INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru


                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                      14192.168.2.44979213.107.246.454437832C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:23:57 UTC192OUTGET /rules/rule120612v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:23:57 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:23:57 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 471
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT
                                                      ETag: "0x8DC582BB10C598B"
                                                      x-ms-request-id: 73fc0cc0-d01e-008e-5fee-16387a000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112357Z-1657d5bbd487nf59mzf5b3gk8n000000034g000000001tay
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:23:57 UTC471INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      15192.168.2.44979313.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:23:57 UTC192OUTGET /rules/rule120613v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:23:57 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:23:57 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 632
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT
                                                      ETag: "0x8DC582BB6E3779E"
                                                      x-ms-request-id: 15158de7-401e-0029-4b00-179b43000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112357Z-1657d5bbd4824mj9d6vp65b6n400000003gg00000000f998
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:23:57 UTC632INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      16192.168.2.44978913.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:23:57 UTC192OUTGET /rules/rule120609v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:23:57 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:23:57 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 408
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT
                                                      ETag: "0x8DC582BB56D3AFB"
                                                      x-ms-request-id: b27588a3-a01e-003d-6001-1798d7000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112357Z-1657d5bbd48lknvp09v995n790000000031g000000008eat
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:23:57 UTC408INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">


                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                      17192.168.2.4497944.175.87.197443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:23:58 UTC306OUTGET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=VHV8A9Yd+22nUsD&MD=9zWC1dr4 HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept: */*
                                                      User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33
                                                      Host: slscr.update.microsoft.com
                                                      2024-10-07 11:23:59 UTC560INHTTP/1.1 200 OK
                                                      Cache-Control: no-cache
                                                      Pragma: no-cache
                                                      Content-Type: application/octet-stream
                                                      Expires: -1
                                                      Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT
                                                      ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440"
                                                      MS-CorrelationId: e95771a2-6c76-486b-9455-e20a5e3cc944
                                                      MS-RequestId: 484d2d0e-43d5-4dff-abee-5863b74717d5
                                                      MS-CV: A7W3QPHe6E68GUSm.0
                                                      X-Microsoft-SLSClientCache: 1440
                                                      Content-Disposition: attachment; filename=environment.cab
                                                      X-Content-Type-Options: nosniff
                                                      Date: Mon, 07 Oct 2024 11:23:58 GMT
                                                      Connection: close
                                                      Content-Length: 30005
                                                      2024-10-07 11:23:59 UTC15824INData Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e
                                                      Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
                                                      2024-10-07 11:23:59 UTC14181INData Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f
                                                      Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      18192.168.2.44979913.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:23:58 UTC192OUTGET /rules/rule120618v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:23:59 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:23:58 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 486
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT
                                                      ETag: "0x8DC582B9018290B"
                                                      x-ms-request-id: bf7deccb-401e-0064-0f0e-1754af000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112358Z-1657d5bbd48vhs7r2p1ky7cs5w00000003mg00000000f8bu
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:23:59 UTC486INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      19192.168.2.44979713.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:23:58 UTC192OUTGET /rules/rule120616v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:23:59 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:23:58 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 486
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT
                                                      ETag: "0x8DC582BB344914B"
                                                      x-ms-request-id: 0a3893d3-c01e-0082-33ee-16af72000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112358Z-1657d5bbd48xdq5dkwwugdpzr000000003ug000000000gtr
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:23:59 UTC486INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      20192.168.2.44979813.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:23:58 UTC192OUTGET /rules/rule120617v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:23:59 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:23:58 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 427
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT
                                                      ETag: "0x8DC582BA310DA18"
                                                      x-ms-request-id: 915c1ee4-001e-0079-3000-1712e8000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112358Z-1657d5bbd482lxwq1dp2t1zwkc000000033000000000dfc6
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:23:59 UTC427INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      21192.168.2.44979613.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:23:58 UTC192OUTGET /rules/rule120615v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:23:59 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:23:58 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 407
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT
                                                      ETag: "0x8DC582BBAD04B7B"
                                                      x-ms-request-id: 789c8418-601e-0032-5905-17eebb000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112358Z-1657d5bbd482krtfgrg72dfbtn0000000360000000005t8c
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:23:59 UTC407INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      22192.168.2.44979513.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:23:58 UTC192OUTGET /rules/rule120614v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:23:59 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:23:58 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 467
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT
                                                      ETag: "0x8DC582BA6C038BC"
                                                      x-ms-request-id: 87fc294c-201e-0051-40f3-167340000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112358Z-1657d5bbd48jwrqbupe3ktsx9w00000003n0000000007s57
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:23:59 UTC467INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      23192.168.2.44980113.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:23:59 UTC192OUTGET /rules/rule120620v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:00 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:23:59 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 469
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT
                                                      ETag: "0x8DC582BBA701121"
                                                      x-ms-request-id: e72ec3ca-501e-005b-2401-17d7f7000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112359Z-1657d5bbd48xdq5dkwwugdpzr000000003qg00000000ape0
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:00 UTC469INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      24192.168.2.44980213.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:23:59 UTC192OUTGET /rules/rule120621v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:00 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:23:59 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 415
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT
                                                      ETag: "0x8DC582BA41997E3"
                                                      x-ms-request-id: 27ba9a72-001e-0046-2a01-17da4b000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112359Z-1657d5bbd48xsz2nuzq4vfrzg800000003bg000000002k15
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:00 UTC415INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      25192.168.2.44980413.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:23:59 UTC192OUTGET /rules/rule120623v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:00 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:23:59 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 464
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT
                                                      ETag: "0x8DC582B97FB6C3C"
                                                      x-ms-request-id: 5a59384b-a01e-0053-3602-178603000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112359Z-1657d5bbd4824mj9d6vp65b6n400000003gg00000000f9d0
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:00 UTC464INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      26192.168.2.44980313.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:23:59 UTC192OUTGET /rules/rule120622v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:00 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:23:59 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 477
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT
                                                      ETag: "0x8DC582BB8CEAC16"
                                                      x-ms-request-id: c2d0a885-201e-0003-7ced-16f85a000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112359Z-1657d5bbd48762wn1qw4s5sd300000000390000000008szc
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:00 UTC477INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      27192.168.2.44980013.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:23:59 UTC192OUTGET /rules/rule120619v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:00 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:23:59 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 407
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT
                                                      ETag: "0x8DC582B9698189B"
                                                      x-ms-request-id: 99ffd5e0-b01e-0053-0101-17cdf8000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112359Z-1657d5bbd4824mj9d6vp65b6n400000003h000000000cuwa
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:00 UTC407INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      28192.168.2.44980613.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:00 UTC192OUTGET /rules/rule120625v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:00 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:00 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 419
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT
                                                      ETag: "0x8DC582B9748630E"
                                                      x-ms-request-id: 09392ef7-101e-0046-3f05-1791b0000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112400Z-1657d5bbd48vhs7r2p1ky7cs5w00000003u0000000001wc3
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:00 UTC419INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      29192.168.2.44980513.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:00 UTC192OUTGET /rules/rule120624v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:00 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:00 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 494
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT
                                                      ETag: "0x8DC582BB7010D66"
                                                      x-ms-request-id: d3d0b776-b01e-003d-1803-17d32c000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112400Z-1657d5bbd48jwrqbupe3ktsx9w00000003n0000000007s7f
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:00 UTC494INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      30192.168.2.44980713.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:00 UTC192OUTGET /rules/rule120626v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:00 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:00 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 472
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT
                                                      ETag: "0x8DC582B9DACDF62"
                                                      x-ms-request-id: 20b36261-201e-006e-7102-17bbe3000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112400Z-1657d5bbd48lknvp09v995n79000000002z000000000dm25
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:00 UTC472INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      31192.168.2.44980813.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:00 UTC192OUTGET /rules/rule120627v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:00 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:00 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 404
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT
                                                      ETag: "0x8DC582B9E8EE0F3"
                                                      x-ms-request-id: f57b7c9f-801e-00a0-4a13-172196000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112400Z-1657d5bbd48f7nlxc7n5fnfzh000000002z000000000efdx
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:00 UTC404INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      32192.168.2.44980913.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:00 UTC192OUTGET /rules/rule120628v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:00 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:00 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 468
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT
                                                      ETag: "0x8DC582B9C8E04C8"
                                                      x-ms-request-id: d112c6a6-a01e-000d-2160-17d1ea000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112400Z-1657d5bbd48lknvp09v995n79000000002z000000000dm27
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:00 UTC468INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      33192.168.2.44981213.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:01 UTC192OUTGET /rules/rule120631v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:01 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:01 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 415
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT
                                                      ETag: "0x8DC582B988EBD12"
                                                      x-ms-request-id: c530354f-501e-0016-5013-17181b000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112401Z-1657d5bbd48sdh4cyzadbb3748000000037g000000009yu2
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:01 UTC415INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      34192.168.2.44981013.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:01 UTC192OUTGET /rules/rule120629v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:01 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:01 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 428
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT
                                                      ETag: "0x8DC582BAC4F34CA"
                                                      x-ms-request-id: 6be05283-001e-00a2-2700-17d4d5000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112401Z-1657d5bbd48lknvp09v995n790000000032g000000005wct
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:01 UTC428INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      35192.168.2.44981113.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:01 UTC192OUTGET /rules/rule120630v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:01 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:01 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 499
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT
                                                      ETag: "0x8DC582B98CEC9F6"
                                                      x-ms-request-id: 40323690-a01e-0002-0100-175074000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112401Z-1657d5bbd48xdq5dkwwugdpzr000000003r00000000097hy
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:01 UTC499INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      36192.168.2.44981313.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:01 UTC192OUTGET /rules/rule120632v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:01 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:01 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 471
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT
                                                      ETag: "0x8DC582BB5815C4C"
                                                      x-ms-request-id: 7cec3a6f-e01e-0033-3414-174695000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112401Z-1657d5bbd48jwrqbupe3ktsx9w00000003m000000000a97a
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:01 UTC471INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      37192.168.2.44981413.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:01 UTC192OUTGET /rules/rule120633v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:01 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:01 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 419
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT
                                                      ETag: "0x8DC582BB32BB5CB"
                                                      x-ms-request-id: d415a278-e01e-0051-6efe-1684b2000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112401Z-1657d5bbd48f7nlxc7n5fnfzh000000002y000000000fqw9
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:01 UTC419INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      38192.168.2.44981613.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:02 UTC192OUTGET /rules/rule120635v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:02 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:02 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 420
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT
                                                      ETag: "0x8DC582B9DAE3EC0"
                                                      x-ms-request-id: 13aa935b-d01e-0014-4baa-18ed58000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112402Z-1657d5bbd48hzllksrq1r6zsvs00000000gg0000000085y3
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:02 UTC420INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      39192.168.2.44981513.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:02 UTC192OUTGET /rules/rule120634v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:02 UTC471INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:02 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 494
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT
                                                      ETag: "0x8DC582BB8972972"
                                                      x-ms-request-id: 13be5939-001e-0082-5bab-185880000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112402Z-1657d5bbd48hzllksrq1r6zsvs00000000m000000000702a
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_MISS
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:02 UTC494INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      40192.168.2.44981713.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:02 UTC192OUTGET /rules/rule120636v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:02 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:02 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 472
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT
                                                      ETag: "0x8DC582B9D43097E"
                                                      x-ms-request-id: b27116a7-a01e-003d-3a00-1798d7000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112402Z-1657d5bbd48xlwdx82gahegw4000000003m0000000009yv5
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:02 UTC472INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      41192.168.2.44981913.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:02 UTC192OUTGET /rules/rule120638v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:02 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:02 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 486
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT
                                                      ETag: "0x8DC582B92FCB436"
                                                      x-ms-request-id: 92e59db7-001e-002b-6700-1799f2000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112402Z-1657d5bbd48jwrqbupe3ktsx9w00000003kg00000000b1gy
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:02 UTC486INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      42192.168.2.44981813.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:02 UTC192OUTGET /rules/rule120637v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:02 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:02 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 427
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT
                                                      ETag: "0x8DC582BA909FA21"
                                                      x-ms-request-id: a62739ea-301e-005d-6402-17e448000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112402Z-1657d5bbd48f7nlxc7n5fnfzh00000000310000000009fd4
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:02 UTC427INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      43192.168.2.44982113.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:03 UTC192OUTGET /rules/rule120640v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:03 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:03 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 478
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT
                                                      ETag: "0x8DC582B9B233827"
                                                      x-ms-request-id: 4dd19665-401e-005b-7705-179c0c000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112403Z-1657d5bbd48vhs7r2p1ky7cs5w00000003m000000000h1rr
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:03 UTC478INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      44192.168.2.44982313.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:03 UTC192OUTGET /rules/rule120642v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:03 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:03 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 468
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT
                                                      ETag: "0x8DC582BB046B576"
                                                      x-ms-request-id: 6e15f9ce-e01e-0052-649d-18d9df000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112403Z-1657d5bbd48hzllksrq1r6zsvs00000000hg0000000071vk
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:03 UTC468INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      45192.168.2.44982013.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:03 UTC192OUTGET /rules/rule120639v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:03 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:03 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 423
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT
                                                      ETag: "0x8DC582BB7564CE8"
                                                      x-ms-request-id: a2d01d3c-801e-0083-4800-17f0ae000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112403Z-1657d5bbd48t66tjar5xuq22r800000003e0000000004yft
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:03 UTC423INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      46192.168.2.44982413.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:03 UTC192OUTGET /rules/rule120643v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:03 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:03 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 400
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT
                                                      ETag: "0x8DC582BB2D62837"
                                                      x-ms-request-id: 11b227e2-601e-0002-7f6b-17a786000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112403Z-1657d5bbd48762wn1qw4s5sd300000000390000000008t42
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:03 UTC400INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      47192.168.2.44982213.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:03 UTC192OUTGET /rules/rule120641v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:03 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:03 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 404
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT
                                                      ETag: "0x8DC582B95C61A3C"
                                                      x-ms-request-id: 151ca1e1-401e-0029-2b03-179b43000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112403Z-1657d5bbd48qjg85buwfdynm5w00000003f000000000awtu
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:03 UTC404INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      48192.168.2.44982813.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:04 UTC192OUTGET /rules/rule120646v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:04 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:04 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 475
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT
                                                      ETag: "0x8DC582BB2BE84FD"
                                                      x-ms-request-id: c5dbf9be-001e-0017-2cf1-160c3c000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112404Z-1657d5bbd487nf59mzf5b3gk8n00000002z000000000c0sh
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:04 UTC475INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      49192.168.2.44982713.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:04 UTC192OUTGET /rules/rule120648v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:04 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:04 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 491
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT
                                                      ETag: "0x8DC582B98B88612"
                                                      x-ms-request-id: 721d8bd8-801e-002a-4f00-1731dc000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112404Z-1657d5bbd48tqvfc1ysmtbdrg0000000036000000000e0w2
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:04 UTC491INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      50192.168.2.44982513.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:04 UTC192OUTGET /rules/rule120644v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:04 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:04 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 479
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT
                                                      ETag: "0x8DC582BB7D702D0"
                                                      x-ms-request-id: 1be548a6-001e-00a2-4166-17d4d5000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112404Z-1657d5bbd482krtfgrg72dfbtn000000032000000000ebgu
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:04 UTC479INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      51192.168.2.44982913.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:04 UTC192OUTGET /rules/rule120647v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:04 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:04 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 448
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT
                                                      ETag: "0x8DC582BB389F49B"
                                                      x-ms-request-id: 5a5a1e5c-a01e-001e-18f5-1649ef000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112404Z-1657d5bbd48xsz2nuzq4vfrzg8000000038g000000009r7d
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:04 UTC448INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      52192.168.2.44982613.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:04 UTC192OUTGET /rules/rule120645v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:04 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:04 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 425
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT
                                                      ETag: "0x8DC582BBA25094F"
                                                      x-ms-request-id: 678daa67-201e-00aa-3f60-173928000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112404Z-1657d5bbd48f7nlxc7n5fnfzh00000000350000000000f3v
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:04 UTC425INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      53192.168.2.44983113.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:05 UTC192OUTGET /rules/rule120649v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:05 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:05 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 416
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT
                                                      ETag: "0x8DC582BAEA4B445"
                                                      x-ms-request-id: cb78c1b2-201e-003f-2e04-176d94000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112405Z-1657d5bbd48q6t9vvmrkd293mg00000003fg000000001chn
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:05 UTC416INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      54192.168.2.44983213.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:05 UTC192OUTGET /rules/rule120650v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:05 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:05 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 479
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT
                                                      ETag: "0x8DC582B989EE75B"
                                                      x-ms-request-id: 27b6de9f-001e-0046-1e00-17da4b000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112405Z-1657d5bbd48xdq5dkwwugdpzr000000003r00000000097s2
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:05 UTC479INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      55192.168.2.44983413.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:05 UTC192OUTGET /rules/rule120652v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:05 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:05 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 471
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT
                                                      ETag: "0x8DC582B97E6FCDD"
                                                      x-ms-request-id: 2f3972b1-401e-0035-1b02-1782d8000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112405Z-1657d5bbd482lxwq1dp2t1zwkc000000037g0000000032q3
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:05 UTC471INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      56192.168.2.44983313.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:05 UTC192OUTGET /rules/rule120651v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:05 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:05 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 415
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT
                                                      ETag: "0x8DC582BA80D96A1"
                                                      x-ms-request-id: 04801829-801e-00ac-6301-17fd65000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112405Z-1657d5bbd48tqvfc1ysmtbdrg0000000039g000000006r1s
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:05 UTC415INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      57192.168.2.44983513.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:05 UTC192OUTGET /rules/rule120653v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:05 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:05 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 419
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT
                                                      ETag: "0x8DC582B9C710B28"
                                                      x-ms-request-id: 1ed82642-401e-0048-7b12-170409000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112405Z-1657d5bbd482krtfgrg72dfbtn000000034g000000008wg6
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:05 UTC419INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      58192.168.2.44983613.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:05 UTC192OUTGET /rules/rule120654v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:06 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:05 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 477
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT
                                                      ETag: "0x8DC582BA54DCC28"
                                                      x-ms-request-id: cde3aec9-601e-0084-63e5-166b3f000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112405Z-1657d5bbd48tnj6wmberkg2xy800000003kg000000002f1q
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:06 UTC477INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      59192.168.2.44984013.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:06 UTC192OUTGET /rules/rule120658v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:06 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:06 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 472
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT
                                                      ETag: "0x8DC582BB650C2EC"
                                                      x-ms-request-id: d803a4ff-401e-0083-3904-17075c000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112406Z-1657d5bbd482lxwq1dp2t1zwkc000000036g000000005gru
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:06 UTC472INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      60192.168.2.44983713.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:06 UTC192OUTGET /rules/rule120655v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:06 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:06 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 419
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT
                                                      ETag: "0x8DC582BB7F164C3"
                                                      x-ms-request-id: 3a03d6b9-d01e-0066-52e9-16ea17000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112406Z-1657d5bbd48tnj6wmberkg2xy800000003d000000000dq01
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:06 UTC419INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      61192.168.2.44983813.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:06 UTC192OUTGET /rules/rule120656v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:06 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:06 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 477
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT
                                                      ETag: "0x8DC582BA48B5BDD"
                                                      x-ms-request-id: 678513bd-b01e-0053-4460-17cdf8000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112406Z-1657d5bbd48dfrdj7px744zp8s000000034000000000an3x
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:06 UTC477INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      62192.168.2.44983913.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:06 UTC192OUTGET /rules/rule120657v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:06 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:06 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 419
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT
                                                      ETag: "0x8DC582B9FF95F80"
                                                      x-ms-request-id: 46a5aa72-701e-0032-6004-17a540000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112406Z-1657d5bbd48t66tjar5xuq22r800000003a000000000d00g
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:06 UTC419INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      63192.168.2.44984113.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:07 UTC192OUTGET /rules/rule120659v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:07 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:07 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 468
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT
                                                      ETag: "0x8DC582BB3EAF226"
                                                      x-ms-request-id: b0fdb72d-401e-0015-37ce-160e8d000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112407Z-1657d5bbd48qjg85buwfdynm5w00000003gg00000000830y
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:07 UTC468INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      64192.168.2.44984313.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:07 UTC192OUTGET /rules/rule120661v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:07 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:07 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 411
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT
                                                      ETag: "0x8DC582B989AF051"
                                                      x-ms-request-id: 8d044b15-901e-00ac-3902-17b69e000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112407Z-1657d5bbd482lxwq1dp2t1zwkc000000031g00000000f9zr
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:07 UTC411INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      65192.168.2.44984513.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:07 UTC192OUTGET /rules/rule120663v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:07 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:07 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 427
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT
                                                      ETag: "0x8DC582BB556A907"
                                                      x-ms-request-id: 0377c3fc-101e-000b-65dc-165e5c000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112407Z-1657d5bbd48gqrfwecymhhbfm8000000026g00000000ambf
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:07 UTC427INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      66192.168.2.44984413.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:07 UTC192OUTGET /rules/rule120662v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:07 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:07 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 470
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT
                                                      ETag: "0x8DC582BBB181F65"
                                                      x-ms-request-id: e72b6989-501e-005b-2b00-17d7f7000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112407Z-1657d5bbd48wd55zet5pcra0cg00000003fg0000000014x7
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:07 UTC470INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      67192.168.2.44984213.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:07 UTC192OUTGET /rules/rule120660v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:07 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:07 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 485
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT
                                                      ETag: "0x8DC582BB9769355"
                                                      x-ms-request-id: 8d3bec0a-601e-0070-32fe-16a0c9000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112407Z-1657d5bbd48xdq5dkwwugdpzr000000003tg000000003e3m
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:07 UTC485INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      68192.168.2.44984713.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:07 UTC192OUTGET /rules/rule120664v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:07 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:07 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 502
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT
                                                      ETag: "0x8DC582BB6A0D312"
                                                      x-ms-request-id: a5e58c1d-b01e-00ab-5ac9-16dafd000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112407Z-1657d5bbd48xlwdx82gahegw4000000003m0000000009z2c
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:07 UTC502INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      69192.168.2.44984613.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:07 UTC192OUTGET /rules/rule120665v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:07 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:07 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 407
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT
                                                      ETag: "0x8DC582B9D30478D"
                                                      x-ms-request-id: 78a0432a-701e-001e-1805-17f5e6000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112407Z-1657d5bbd48tqvfc1ysmtbdrg000000003bg000000002aey
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:07 UTC407INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      70192.168.2.44984813.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:07 UTC192OUTGET /rules/rule120666v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:07 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:07 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 474
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT
                                                      ETag: "0x8DC582BB3F48DAE"
                                                      x-ms-request-id: ef9cab6f-f01e-0099-0d00-179171000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112407Z-1657d5bbd48jwrqbupe3ktsx9w00000003mg000000008pgn
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:07 UTC474INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      71192.168.2.44984913.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:07 UTC192OUTGET /rules/rule120667v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:07 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:07 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 408
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT
                                                      ETag: "0x8DC582BB9B6040B"
                                                      x-ms-request-id: 2f519f63-901e-0016-75ff-16efe9000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112407Z-1657d5bbd48q6t9vvmrkd293mg00000003a000000000d86g
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:07 UTC408INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      72192.168.2.44985013.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:07 UTC192OUTGET /rules/rule120668v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:07 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:07 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 469
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT
                                                      ETag: "0x8DC582BB3CAEBB8"
                                                      x-ms-request-id: b67c2655-301e-0096-2300-17e71d000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112407Z-1657d5bbd48q6t9vvmrkd293mg00000003b000000000bq4d
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:07 UTC469INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      73192.168.2.44985313.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:08 UTC192OUTGET /rules/rule120671v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:08 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:08 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 432
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT
                                                      ETag: "0x8DC582BAABA2A10"
                                                      x-ms-request-id: bfab55ab-401e-0015-6202-170e8d000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112408Z-1657d5bbd48tnj6wmberkg2xy800000003m00000000015w7
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:08 UTC432INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      74192.168.2.44985113.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:08 UTC192OUTGET /rules/rule120669v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:08 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:08 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 416
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT
                                                      ETag: "0x8DC582BB5284CCE"
                                                      x-ms-request-id: 821e4157-c01e-0014-3301-17a6a3000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112408Z-1657d5bbd482tlqpvyz9e93p5400000003g0000000007qpg
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:08 UTC416INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      75192.168.2.44985213.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:08 UTC192OUTGET /rules/rule120670v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:08 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:08 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 472
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT
                                                      ETag: "0x8DC582B91EAD002"
                                                      x-ms-request-id: 763e8d43-601e-000d-6912-172618000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112408Z-1657d5bbd48gqrfwecymhhbfm8000000026g00000000amdn
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:08 UTC472INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      76192.168.2.44985413.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:08 UTC192OUTGET /rules/rule120672v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:08 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:08 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 475
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT
                                                      ETag: "0x8DC582BBA740822"
                                                      x-ms-request-id: 01bf113a-f01e-003c-3703-178cf0000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112408Z-1657d5bbd48vhs7r2p1ky7cs5w00000003qg000000009mam
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:08 UTC475INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      77192.168.2.44985513.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:08 UTC192OUTGET /rules/rule120673v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:08 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:08 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 427
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT
                                                      ETag: "0x8DC582BB464F255"
                                                      x-ms-request-id: 7875ffac-201e-000c-7f02-1779c4000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112408Z-1657d5bbd48tqvfc1ysmtbdrg0000000035000000000eyzy
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:08 UTC427INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      78192.168.2.44985613.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:09 UTC192OUTGET /rules/rule120674v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:09 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:09 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 474
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT
                                                      ETag: "0x8DC582BA4037B0D"
                                                      x-ms-request-id: 3b7b7106-501e-0064-43e7-161f54000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112409Z-1657d5bbd48tqvfc1ysmtbdrg0000000039g000000006r5x
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:09 UTC474INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      79192.168.2.44985713.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:09 UTC192OUTGET /rules/rule120675v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:09 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:09 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 419
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT
                                                      ETag: "0x8DC582BA6CF78C8"
                                                      x-ms-request-id: 3c7823fd-401e-0015-0c60-170e8d000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112409Z-1657d5bbd48lknvp09v995n7900000000310000000009m1n
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:09 UTC419INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      80192.168.2.44985813.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:09 UTC192OUTGET /rules/rule120676v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:09 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:09 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 472
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT
                                                      ETag: "0x8DC582B984BF177"
                                                      x-ms-request-id: 2f576d96-401e-0047-3902-178597000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112409Z-1657d5bbd48t66tjar5xuq22r800000003b000000000b0re
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:09 UTC472INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      81192.168.2.44985913.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:09 UTC192OUTGET /rules/rule120677v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:09 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:09 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 405
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT
                                                      ETag: "0x8DC582B942B6AFF"
                                                      x-ms-request-id: dfb96d6a-f01e-003f-17e5-16d19d000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112409Z-1657d5bbd48wd55zet5pcra0cg000000039g00000000e8k0
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:09 UTC405INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      82192.168.2.44986013.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:09 UTC192OUTGET /rules/rule120678v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:09 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:09 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 468
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT
                                                      ETag: "0x8DC582BBA642BF4"
                                                      x-ms-request-id: 488e22d8-201e-003c-6178-1830f9000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112409Z-1657d5bbd48hzllksrq1r6zsvs00000000q0000000004yqb
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:09 UTC468INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      83192.168.2.44986313.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:10 UTC192OUTGET /rules/rule120680v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:10 UTC563INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:10 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 1952
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT
                                                      ETag: "0x8DC582B956B0F3D"
                                                      x-ms-request-id: a5ff6bd9-301e-005d-3af2-16e448000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112410Z-1657d5bbd48xlwdx82gahegw4000000003k000000000bxwq
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:10 UTC1952INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      84192.168.2.44986613.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:10 UTC193OUTGET /rules/rule120602v10s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:10 UTC563INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:10 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 2592
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT
                                                      ETag: "0x8DC582BB5B890DB"
                                                      x-ms-request-id: 33b4d0ae-a01e-0032-35ff-161949000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112410Z-1657d5bbd48brl8we3nu8cxwgn00000003r0000000008f4g
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:10 UTC2592INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      85192.168.2.44986413.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:10 UTC192OUTGET /rules/rule120681v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:10 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:10 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 958
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT
                                                      ETag: "0x8DC582BA0A31B3B"
                                                      x-ms-request-id: 0c165d1d-a01e-000d-7dfe-16d1ea000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112410Z-1657d5bbd482krtfgrg72dfbtn000000033g00000000arac
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:10 UTC958INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      86192.168.2.44986213.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:10 UTC192OUTGET /rules/rule120679v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:10 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:10 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 174
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT
                                                      ETag: "0x8DC582B91D80E15"
                                                      x-ms-request-id: 0607cd43-401e-0078-1b00-174d34000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112410Z-1657d5bbd48dfrdj7px744zp8s000000033g00000000bvwb
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:10 UTC174INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      87192.168.2.44986513.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:10 UTC192OUTGET /rules/rule120682v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:10 UTC470INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:10 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 501
                                                      Connection: close
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT
                                                      ETag: "0x8DC582BACFDAACD"
                                                      x-ms-request-id: c2f609cb-201e-0003-75fd-16f85a000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112410Z-1657d5bbd48xdq5dkwwugdpzr000000003s0000000006rwf
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:10 UTC501INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      88192.168.2.44986813.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:11 UTC193OUTGET /rules/rule224901v11s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:11 UTC563INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:11 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 2284
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT
                                                      ETag: "0x8DC582BCD58BEEE"
                                                      x-ms-request-id: b738acd5-401e-0067-1502-1709c2000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112411Z-1657d5bbd48sdh4cyzadbb3748000000038g00000000772v
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:11 UTC2284INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      89192.168.2.44987013.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:11 UTC192OUTGET /rules/rule701200v1s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:11 UTC563INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:11 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 1356
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT
                                                      ETag: "0x8DC582BDC681E17"
                                                      x-ms-request-id: 0480ed94-801e-00ac-5102-17fd65000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112411Z-1657d5bbd48jwrqbupe3ktsx9w00000003q000000000390b
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:11 UTC1356INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      90192.168.2.44986713.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:11 UTC192OUTGET /rules/rule120601v3s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:11 UTC563INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:11 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 3342
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT
                                                      ETag: "0x8DC582B927E47E9"
                                                      x-ms-request-id: 960edd56-701e-005c-4100-17bb94000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112411Z-1657d5bbd48vhs7r2p1ky7cs5w00000003qg000000009me8
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:11 UTC3342INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      91192.168.2.44987113.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:11 UTC192OUTGET /rules/rule700201v1s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:11 UTC563INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:11 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 1393
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT
                                                      ETag: "0x8DC582BE39DFC9B"
                                                      x-ms-request-id: b72ef555-401e-0067-78fe-1609c2000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112411Z-1657d5bbd48xlwdx82gahegw4000000003pg000000003ns2
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:11 UTC1393INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      92192.168.2.44986913.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:11 UTC192OUTGET /rules/rule701201v1s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:11 UTC563INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:11 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 1393
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT
                                                      ETag: "0x8DC582BE3E55B6E"
                                                      x-ms-request-id: 8a5fd43d-c01e-0066-4506-17a1ec000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112411Z-1657d5bbd48f7nlxc7n5fnfzh000000002z000000000eg10
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:11 UTC1393INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      93192.168.2.44987213.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:11 UTC192OUTGET /rules/rule700200v1s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:11 UTC563INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:11 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 1356
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT
                                                      ETag: "0x8DC582BDF66E42D"
                                                      x-ms-request-id: db28c537-d01e-0065-47fe-16b77a000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112411Z-1657d5bbd48wd55zet5pcra0cg00000003bg000000009vyx
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:11 UTC1356INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      94192.168.2.44987313.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:11 UTC192OUTGET /rules/rule702351v1s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:11 UTC563INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:11 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 1395
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT
                                                      ETag: "0x8DC582BE017CAD3"
                                                      x-ms-request-id: cb759915-201e-003f-5f03-176d94000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112411Z-1657d5bbd48jwrqbupe3ktsx9w00000003qg000000002563
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:11 UTC1395INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      95192.168.2.44987513.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:11 UTC192OUTGET /rules/rule701251v1s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:11 UTC563INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:11 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 1395
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT
                                                      ETag: "0x8DC582BDE12A98D"
                                                      x-ms-request-id: 03c3f781-101e-000b-56fe-165e5c000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112411Z-1657d5bbd48q6t9vvmrkd293mg00000003bg00000000a5ag
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:11 UTC1395INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      96192.168.2.44987613.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:11 UTC192OUTGET /rules/rule701250v1s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:11 UTC563INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:11 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 1358
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT
                                                      ETag: "0x8DC582BE022ECC5"
                                                      x-ms-request-id: 6ed4a116-c01e-0034-079f-182af6000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112411Z-1657d5bbd48hzllksrq1r6zsvs00000000p0000000006hmw
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:11 UTC1358INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      97192.168.2.44987413.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:11 UTC192OUTGET /rules/rule702350v1s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:11 UTC563INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:11 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 1358
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT
                                                      ETag: "0x8DC582BE6431446"
                                                      x-ms-request-id: 84e7aa3f-c01e-008e-74ff-167381000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112411Z-1657d5bbd48vlsxxpe15ac3q7n000000039000000000dxgz
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:11 UTC1358INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      98192.168.2.44987713.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:12 UTC192OUTGET /rules/rule700051v1s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:12 UTC563INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:12 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 1389
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT
                                                      ETag: "0x8DC582BE10A6BC1"
                                                      x-ms-request-id: 29f28342-e01e-003c-5d00-17c70b000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112412Z-1657d5bbd48q6t9vvmrkd293mg00000003eg000000003qn3
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:12 UTC1389INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      99192.168.2.44987813.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:12 UTC192OUTGET /rules/rule700050v1s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:12 UTC563INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:12 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 1352
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT
                                                      ETag: "0x8DC582BE9DEEE28"
                                                      x-ms-request-id: a9a45936-c01e-00a1-54f1-167e4a000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112412Z-1657d5bbd48wd55zet5pcra0cg00000003fg00000000156q
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:12 UTC1352INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      100192.168.2.44988013.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:12 UTC192OUTGET /rules/rule702950v1s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:12 UTC563INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:12 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 1368
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT
                                                      ETag: "0x8DC582BDDC22447"
                                                      x-ms-request-id: 173e0f62-801e-00a3-24fe-167cfb000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112412Z-1657d5bbd48gqrfwecymhhbfm8000000025g00000000bqm0
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:12 UTC1368INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      101192.168.2.44987913.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:12 UTC192OUTGET /rules/rule702951v1s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:12 UTC563INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:12 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 1405
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT
                                                      ETag: "0x8DC582BE12B5C71"
                                                      x-ms-request-id: c7b66cba-b01e-005c-04ff-164c66000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112412Z-1657d5bbd48brl8we3nu8cxwgn00000003n000000000e9hr
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:12 UTC1405INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      102192.168.2.44988113.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:12 UTC192OUTGET /rules/rule701151v1s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:12 UTC563INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:12 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 1401
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT
                                                      ETag: "0x8DC582BE055B528"
                                                      x-ms-request-id: 6bee43b5-001e-00a2-2106-17d4d5000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112412Z-1657d5bbd48xlwdx82gahegw4000000003n00000000078xt
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:12 UTC1401INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      103192.168.2.44988213.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:13 UTC192OUTGET /rules/rule701150v1s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:13 UTC563INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:13 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 1364
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT
                                                      ETag: "0x8DC582BE1223606"
                                                      x-ms-request-id: 04600955-801e-00ac-55f4-16fd65000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112413Z-1657d5bbd48xdq5dkwwugdpzr000000003u00000000023k6
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:13 UTC1364INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      104192.168.2.44988313.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:13 UTC192OUTGET /rules/rule702201v1s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:13 UTC563INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:13 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 1397
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT
                                                      ETag: "0x8DC582BE7262739"
                                                      x-ms-request-id: 4035d6e2-a01e-0002-4602-175074000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112413Z-1657d5bbd48cpbzgkvtewk0wu000000003eg00000000b9ng
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:13 UTC1397INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      105192.168.2.44988413.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:13 UTC192OUTGET /rules/rule702200v1s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:13 UTC563INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:13 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 1360
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT
                                                      ETag: "0x8DC582BDDEB5124"
                                                      x-ms-request-id: 62f7f1ae-f01e-0096-4d0c-1710ef000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112413Z-1657d5bbd48sqtlf1huhzuwq700000000370000000002t20
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:13 UTC1360INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      106192.168.2.44988513.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:13 UTC192OUTGET /rules/rule700401v2s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:13 UTC563INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:13 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 1403
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT
                                                      ETag: "0x8DC582BDCB4853F"
                                                      x-ms-request-id: 87e26173-201e-0051-15e7-167340000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112413Z-1657d5bbd48t66tjar5xuq22r800000003b000000000b0xd
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:13 UTC1403INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      107192.168.2.44988613.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:13 UTC192OUTGET /rules/rule700400v2s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:13 UTC563INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:13 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 1366
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT
                                                      ETag: "0x8DC582BDB779FC3"
                                                      x-ms-request-id: fcca05a5-501e-00a0-3202-179d9f000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112413Z-1657d5bbd48vhs7r2p1ky7cs5w00000003p000000000cxh9
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:13 UTC1366INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      108192.168.2.44988713.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:14 UTC192OUTGET /rules/rule700351v1s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:14 UTC563INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:14 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 1397
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT
                                                      ETag: "0x8DC582BDFD43C07"
                                                      x-ms-request-id: 31868579-401e-008c-0af2-1686c2000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112414Z-1657d5bbd48jwrqbupe3ktsx9w00000003r0000000000ef7
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:14 UTC1397INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      109192.168.2.44988813.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:14 UTC192OUTGET /rules/rule700350v1s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:14 UTC563INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:14 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 1360
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT
                                                      ETag: "0x8DC582BDD74D2EC"
                                                      x-ms-request-id: fbb49b00-e01e-00aa-4806-17ceda000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112414Z-1657d5bbd48tqvfc1ysmtbdrg0000000035000000000ez66
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:14 UTC1360INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      110192.168.2.44988913.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:14 UTC192OUTGET /rules/rule703901v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:14 UTC563INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:14 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 1427
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT
                                                      ETag: "0x8DC582BE56F6873"
                                                      x-ms-request-id: 08bf7a15-f01e-0020-7706-17956b000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112414Z-1657d5bbd48xlwdx82gahegw4000000003hg00000000ctud
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:14 UTC1427INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      111192.168.2.44989013.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:14 UTC192OUTGET /rules/rule703900v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:14 UTC563INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:14 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 1390
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT
                                                      ETag: "0x8DC582BE3002601"
                                                      x-ms-request-id: 7d21ea5d-701e-0098-0502-17395f000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112414Z-1657d5bbd48762wn1qw4s5sd30000000038g00000000a523
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:14 UTC1390INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      112192.168.2.44989113.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:14 UTC192OUTGET /rules/rule701501v1s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:14 UTC563INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:14 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 1401
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT
                                                      ETag: "0x8DC582BE2A9D541"
                                                      x-ms-request-id: b6fa471e-401e-0067-43e5-1609c2000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112414Z-1657d5bbd48qjg85buwfdynm5w00000003k0000000003yge
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:14 UTC1401INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      113192.168.2.44989313.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:15 UTC192OUTGET /rules/rule702801v1s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:15 UTC563INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:15 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 1391
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT
                                                      ETag: "0x8DC582BDF58DC7E"
                                                      x-ms-request-id: a18d9b1d-601e-0002-1f03-17a786000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112415Z-1657d5bbd48dfrdj7px744zp8s000000033000000000c5ts
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:15 UTC1391INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      114192.168.2.44989213.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:15 UTC192OUTGET /rules/rule701500v1s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:15 UTC563INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:15 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 1364
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT
                                                      ETag: "0x8DC582BEB6AD293"
                                                      x-ms-request-id: 77012b0e-b01e-0097-0bff-164f33000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112415Z-1657d5bbd48vlsxxpe15ac3q7n000000039000000000dxqd
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:15 UTC1364INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      115192.168.2.44989613.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:15 UTC192OUTGET /rules/rule703350v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:15 UTC563INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:15 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 1366
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT
                                                      ETag: "0x8DC582BDF1E2608"
                                                      x-ms-request-id: c9f5ea47-201e-0071-33fe-16ff15000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112415Z-1657d5bbd48tqvfc1ysmtbdrg000000003ag000000004pb1
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:15 UTC1366INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      116192.168.2.44989413.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:15 UTC192OUTGET /rules/rule703351v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:15 UTC563INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:15 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 1403
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT
                                                      ETag: "0x8DC582BDCDD6400"
                                                      x-ms-request-id: 4d5cca78-701e-0021-6ae5-163d45000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112415Z-1657d5bbd48qjg85buwfdynm5w00000003dg00000000e2sc
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:15 UTC1403INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      117192.168.2.44989513.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:15 UTC192OUTGET /rules/rule702800v1s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:15 UTC563INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:15 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 1354
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT
                                                      ETag: "0x8DC582BE0662D7C"
                                                      x-ms-request-id: d4fd285a-d01e-005a-06ed-167fd9000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112415Z-1657d5bbd487nf59mzf5b3gk8n00000003100000000099qw
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:15 UTC1354INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      118192.168.2.44989713.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:15 UTC192OUTGET /rules/rule703501v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:15 UTC563INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:15 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 1399
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT
                                                      ETag: "0x8DC582BE8C605FF"
                                                      x-ms-request-id: 635e2ff4-801e-0035-1973-17752a000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112415Z-1657d5bbd48762wn1qw4s5sd30000000039g0000000076bp
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:15 UTC1399INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      119192.168.2.44989913.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:15 UTC192OUTGET /rules/rule701801v1s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:16 UTC563INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:16 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 1403
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT
                                                      ETag: "0x8DC582BDC2EEE03"
                                                      x-ms-request-id: 4d8e5842-701e-0021-0efe-163d45000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112416Z-1657d5bbd48q6t9vvmrkd293mg00000003f0000000002k1r
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:16 UTC1403INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      120192.168.2.44989813.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:15 UTC192OUTGET /rules/rule703500v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:16 UTC563INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:15 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 1362
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT
                                                      ETag: "0x8DC582BDF497570"
                                                      x-ms-request-id: 838d785c-001e-0014-24fe-165151000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112415Z-1657d5bbd48xdq5dkwwugdpzr000000003qg00000000aq69
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:16 UTC1362INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      121192.168.2.44990013.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:16 UTC192OUTGET /rules/rule701800v1s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:16 UTC563INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:16 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 1366
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT
                                                      ETag: "0x8DC582BEA414B16"
                                                      x-ms-request-id: 8a56303a-c01e-0066-0f01-17a1ec000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112416Z-1657d5bbd48tqvfc1ysmtbdrg000000003b0000000003fsk
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:16 UTC1366INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      122192.168.2.44990113.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:16 UTC192OUTGET /rules/rule701051v1s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:16 UTC563INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:16 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 1399
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT
                                                      ETag: "0x8DC582BE1CC18CD"
                                                      x-ms-request-id: cd0b82ba-d01e-0049-1304-17e7dc000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112416Z-1657d5bbd4824mj9d6vp65b6n400000003fg00000000h341
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:16 UTC1399INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      123192.168.2.44990213.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:16 UTC192OUTGET /rules/rule701050v1s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:16 UTC563INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:16 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 1362
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT
                                                      ETag: "0x8DC582BEB256F43"
                                                      x-ms-request-id: 0c184816-a01e-000d-72ff-16d1ea000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112416Z-1657d5bbd48dfrdj7px744zp8s000000034000000000anh5
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:16 UTC1362INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      124192.168.2.44990413.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:16 UTC192OUTGET /rules/rule702750v1s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:16 UTC563INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:16 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 1366
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT
                                                      ETag: "0x8DC582BE5B7B174"
                                                      x-ms-request-id: ca2bab4f-201e-0071-5e14-17ff15000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112416Z-1657d5bbd482lxwq1dp2t1zwkc000000032g00000000dznp
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:16 UTC1366INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      125192.168.2.44990313.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:16 UTC192OUTGET /rules/rule702751v1s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:16 UTC563INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:16 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 1403
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT
                                                      ETag: "0x8DC582BEB866CDB"
                                                      x-ms-request-id: d3a3eb01-b01e-003d-1ef1-16d32c000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112416Z-1657d5bbd48lknvp09v995n79000000003500000000000gq
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:16 UTC1403INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      126192.168.2.44990613.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:16 UTC192OUTGET /rules/rule702300v1s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:16 UTC563INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:16 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 1362
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT
                                                      ETag: "0x8DC582BDC13EFEF"
                                                      x-ms-request-id: 4ef38422-401e-000a-160c-174a7b000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112416Z-1657d5bbd48lknvp09v995n790000000034g0000000017tt
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:16 UTC1362INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      127192.168.2.44990513.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:16 UTC192OUTGET /rules/rule702301v1s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:16 UTC563INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:16 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 1399
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT
                                                      ETag: "0x8DC582BE976026E"
                                                      x-ms-request-id: 4d8e59a4-701e-0021-64fe-163d45000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112416Z-1657d5bbd482krtfgrg72dfbtn000000034g000000008x1d
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:16 UTC1399INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      128192.168.2.44990813.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:17 UTC192OUTGET /rules/rule703401v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:17 UTC563INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:17 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 1425
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT
                                                      ETag: "0x8DC582BE6BD89A1"
                                                      x-ms-request-id: c326dec7-201e-0003-0c12-17f85a000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112417Z-1657d5bbd48vhs7r2p1ky7cs5w00000003ng00000000dtx1
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:17 UTC1425INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      129192.168.2.44990913.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:17 UTC192OUTGET /rules/rule703400v0s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:17 UTC563INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:17 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 1388
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT
                                                      ETag: "0x8DC582BDBD9126E"
                                                      x-ms-request-id: 75ef523f-601e-000d-02f2-162618000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112417Z-1657d5bbd48sqtlf1huhzuwq700000000380000000000e7n
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:17 UTC1388INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      130192.168.2.44991213.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:17 UTC192OUTGET /rules/rule700501v1s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:17 UTC563INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:17 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 1405
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT
                                                      ETag: "0x8DC582BE89A8F82"
                                                      x-ms-request-id: c9f5e5fc-201e-0071-5dfe-16ff15000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112417Z-1657d5bbd482krtfgrg72dfbtn000000034g000000008x27
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:17 UTC1405INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      131192.168.2.44991113.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:17 UTC192OUTGET /rules/rule702500v1s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:17 UTC563INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:17 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 1378
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT
                                                      ETag: "0x8DC582BDB813B3F"
                                                      x-ms-request-id: 87e265fd-201e-0051-4fe7-167340000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112417Z-1657d5bbd48qjg85buwfdynm5w00000003hg00000000591n
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:17 UTC1378INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      132192.168.2.44991013.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:17 UTC192OUTGET /rules/rule702501v1s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:17 UTC563INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:17 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 1415
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT
                                                      ETag: "0x8DC582BE7C66E85"
                                                      x-ms-request-id: cad35e9e-b01e-0021-3602-17cab7000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112417Z-1657d5bbd48xsz2nuzq4vfrzg800000003a0000000005gds
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:17 UTC1415INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      133192.168.2.44991413.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:18 UTC192OUTGET /rules/rule700500v1s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:18 UTC563INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:18 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 1368
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT
                                                      ETag: "0x8DC582BE51CE7B3"
                                                      x-ms-request-id: 3e7839e3-701e-0053-5cff-163a0a000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112418Z-1657d5bbd48qjg85buwfdynm5w00000003h0000000006eyy
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:18 UTC1368INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      134192.168.2.44991513.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:18 UTC192OUTGET /rules/rule702551v1s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:18 UTC563INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:18 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 1415
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT
                                                      ETag: "0x8DC582BDCE9703A"
                                                      x-ms-request-id: 9ee449bf-c01e-0079-5e9f-18e51a000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112418Z-1657d5bbd48hzllksrq1r6zsvs00000000mg000000007kvc
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:18 UTC1415INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan


                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                      135192.168.2.449913142.250.186.1104437832C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:18 UTC1329OUTPOST /log?format=json&hasfast=true&authuser=0 HTTP/1.1
                                                      Host: play.google.com
                                                      Connection: keep-alive
                                                      Content-Length: 1416
                                                      sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                                      sec-ch-ua-mobile: ?0
                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                      sec-ch-ua-arch: "x86"
                                                      Content-Type: application/x-www-form-urlencoded;charset=UTF-8
                                                      sec-ch-ua-full-version: "117.0.5938.132"
                                                      sec-ch-ua-platform-version: "10.0.0"
                                                      X-Goog-AuthUser: 0
                                                      sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"
                                                      sec-ch-ua-bitness: "64"
                                                      sec-ch-ua-model: ""
                                                      sec-ch-ua-wow64: ?0
                                                      sec-ch-ua-platform: "Windows"
                                                      Accept: */*
                                                      Origin: https://accounts.google.com
                                                      X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX
                                                      Sec-Fetch-Site: same-site
                                                      Sec-Fetch-Mode: cors
                                                      Sec-Fetch-Dest: empty
                                                      Referer: https://accounts.google.com/
                                                      Accept-Encoding: gzip, deflate, br
                                                      Accept-Language: en-US,en;q=0.9
                                                      Cookie: NID=518=UwKxF1J0Ty-rCTFpiJigHwx9qSYUjdENylT2S5EBu-d7HIQNmkiBrs4abkKIikW5MuMg8y8ds6lU-LU8nv4jiRSmeAnRyNtpYQ1RYL_SOj8r5MNcOIINVzxGlKqjlDWV01cqxRWVKHaXdZjqwunWYK87d5fkyKvT0B_we7awexcXtsvmvVa4I2zfww
                                                      2024-10-07 11:24:18 UTC1416OUTData Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 33 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 32 38 33 30 30 32 35 36 34 30 34 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c
                                                      Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"31",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],1828,[["1728300256404",null,null,null
                                                      2024-10-07 11:24:18 UTC523INHTTP/1.1 200 OK
                                                      Access-Control-Allow-Origin: https://accounts.google.com
                                                      Cross-Origin-Resource-Policy: cross-origin
                                                      Access-Control-Allow-Credentials: true
                                                      Access-Control-Allow-Headers: X-Playlog-Web
                                                      Content-Type: text/plain; charset=UTF-8
                                                      Date: Mon, 07 Oct 2024 11:24:18 GMT
                                                      Server: Playlog
                                                      Cache-Control: private
                                                      X-XSS-Protection: 0
                                                      X-Frame-Options: SAMEORIGIN
                                                      Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                      Accept-Ranges: none
                                                      Vary: Accept-Encoding
                                                      Connection: close
                                                      Transfer-Encoding: chunked
                                                      2024-10-07 11:24:18 UTC137INData Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a
                                                      Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
                                                      2024-10-07 11:24:18 UTC5INData Raw: 30 0d 0a 0d 0a
                                                      Data Ascii: 0


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      136192.168.2.44991613.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:18 UTC192OUTGET /rules/rule702550v1s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:18 UTC563INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:18 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 1378
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT
                                                      ETag: "0x8DC582BE584C214"
                                                      x-ms-request-id: dfa7567c-f01e-003f-67de-16d19d000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112418Z-1657d5bbd48gqrfwecymhhbfm8000000023g00000000gt93
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:18 UTC1378INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      137192.168.2.44991713.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:18 UTC192OUTGET /rules/rule701351v1s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:18 UTC563INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:18 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 1407
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT
                                                      ETag: "0x8DC582BE687B46A"
                                                      x-ms-request-id: 2d26e6ec-001e-0066-1e78-18561e000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112418Z-1657d5bbd48hzllksrq1r6zsvs00000000g0000000007096
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:18 UTC1407INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      138192.168.2.44991813.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:18 UTC192OUTGET /rules/rule701350v1s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:18 UTC563INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:18 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 1370
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT
                                                      ETag: "0x8DC582BDE62E0AB"
                                                      x-ms-request-id: 838d7376-001e-0014-17fe-165151000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112418Z-1657d5bbd48f7nlxc7n5fnfzh000000002y000000000frfb
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:18 UTC1370INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      139192.168.2.44991913.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:19 UTC192OUTGET /rules/rule702151v1s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:19 UTC563INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:19 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 1397
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT
                                                      ETag: "0x8DC582BE156D2EE"
                                                      x-ms-request-id: 7d18055e-701e-0098-56ff-16395f000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112419Z-1657d5bbd48q6t9vvmrkd293mg00000003dg0000000061f3
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:19 UTC1397INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      140192.168.2.44992113.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:19 UTC192OUTGET /rules/rule703001v1s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:19 UTC563INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:19 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 1406
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT
                                                      ETag: "0x8DC582BEB16F27E"
                                                      x-ms-request-id: 770fdf22-501e-0035-0d02-17c923000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112419Z-1657d5bbd48f7nlxc7n5fnfzh000000002z000000000egm2
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:19 UTC1406INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      141192.168.2.44992213.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:19 UTC192OUTGET /rules/rule703000v1s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:19 UTC563INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:19 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 1369
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT
                                                      ETag: "0x8DC582BE32FE1A2"
                                                      x-ms-request-id: c55b1dc3-701e-0097-42e9-16b8c1000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112419Z-1657d5bbd48sdh4cyzadbb374800000003a00000000046t1
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:19 UTC1369INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T


                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                      142192.168.2.44992013.107.246.454437832C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:19 UTC192OUTGET /rules/rule702150v1s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:19 UTC563INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:19 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 1360
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT
                                                      ETag: "0x8DC582BEDC8193E"
                                                      x-ms-request-id: b1fbfe33-a01e-003d-4fd4-1698d7000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112419Z-1657d5bbd48dfrdj7px744zp8s000000035g0000000072pd
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:19 UTC1360INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      143192.168.2.44992313.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:19 UTC192OUTGET /rules/rule700751v1s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:19 UTC563INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:19 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 1414
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT
                                                      ETag: "0x8DC582BE03B051D"
                                                      x-ms-request-id: 4543d13f-701e-0050-5a04-176767000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112419Z-1657d5bbd482tlqpvyz9e93p5400000003d000000000ccsk
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:19 UTC1414INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      144192.168.2.44992513.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:19 UTC192OUTGET /rules/rule700151v1s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:19 UTC563INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:19 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 1399
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT
                                                      ETag: "0x8DC582BE0A2434F"
                                                      x-ms-request-id: 961c0255-701e-005c-1406-17bb94000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112419Z-1657d5bbd48gqrfwecymhhbfm8000000027g000000008a1x
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:19 UTC1399INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOn


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      145192.168.2.44992413.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:19 UTC192OUTGET /rules/rule700750v1s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:19 UTC563INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:19 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 1377
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT
                                                      ETag: "0x8DC582BEAFF0125"
                                                      x-ms-request-id: fba86ca6-e01e-00aa-5200-17ceda000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112419Z-1657d5bbd48dfrdj7px744zp8s000000035g0000000072x6
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:19 UTC1377INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 44 65 73 6b 74 6f 70 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookDesktop" S="Medium" />


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      146192.168.2.44992613.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:19 UTC192OUTGET /rules/rule700150v1s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:19 UTC563INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:19 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 1362
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT
                                                      ETag: "0x8DC582BE54CA33F"
                                                      x-ms-request-id: 401481e1-301e-0099-6a5a-176683000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112419Z-1657d5bbd48qjg85buwfdynm5w00000003m00000000020kd
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:19 UTC1362INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e 65 4e 6f 74 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOneNote" S="Medium" /> <F T="2">


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      147192.168.2.44992713.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:19 UTC192OUTGET /rules/rule703451v1s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:19 UTC563INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:19 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 1409
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT
                                                      ETag: "0x8DC582BDFC438CF"
                                                      x-ms-request-id: 7cb43a82-e01e-0033-45fe-164695000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112419Z-1657d5bbd48tqvfc1ysmtbdrg000000003bg000000002b5s
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:19 UTC1409INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703451" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTo


                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                      148192.168.2.44992813.107.246.45443
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:19 UTC192OUTGET /rules/rule703450v1s19.xml HTTP/1.1
                                                      Connection: Keep-Alive
                                                      Accept-Encoding: gzip
                                                      User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                      Host: otelrules.azureedge.net
                                                      2024-10-07 11:24:20 UTC563INHTTP/1.1 200 OK
                                                      Date: Mon, 07 Oct 2024 11:24:19 GMT
                                                      Content-Type: text/xml
                                                      Content-Length: 1372
                                                      Connection: close
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Vary: Accept-Encoding
                                                      Cache-Control: public, max-age=604800, immutable
                                                      Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT
                                                      ETag: "0x8DC582BE6669CA7"
                                                      x-ms-request-id: 9139889b-001e-0079-22f3-1612e8000000
                                                      x-ms-version: 2018-03-28
                                                      x-azure-ref: 20241007T112419Z-1657d5bbd48xdq5dkwwugdpzr000000003u00000000023wx
                                                      x-fd-int-roxy-purgeid: 0
                                                      X-Cache: TCP_HIT
                                                      Accept-Ranges: bytes
                                                      2024-10-07 11:24:20 UTC1372INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c
                                                      Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703450" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOfficeMobile" S="Medium" /> <


                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                      149192.168.2.449929142.250.186.1104437832C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      TimestampBytes transferredDirectionData
                                                      2024-10-07 11:24:19 UTC1329OUTPOST /log?format=json&hasfast=true&authuser=0 HTTP/1.1
                                                      Host: play.google.com
                                                      Connection: keep-alive
                                                      Content-Length: 1159
                                                      sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                                      sec-ch-ua-mobile: ?0
                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                      sec-ch-ua-arch: "x86"
                                                      Content-Type: application/x-www-form-urlencoded;charset=UTF-8
                                                      sec-ch-ua-full-version: "117.0.5938.132"
                                                      sec-ch-ua-platform-version: "10.0.0"
                                                      X-Goog-AuthUser: 0
                                                      sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"
                                                      sec-ch-ua-bitness: "64"
                                                      sec-ch-ua-model: ""
                                                      sec-ch-ua-wow64: ?0
                                                      sec-ch-ua-platform: "Windows"
                                                      Accept: */*
                                                      Origin: https://accounts.google.com
                                                      X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX
                                                      Sec-Fetch-Site: same-site
                                                      Sec-Fetch-Mode: cors
                                                      Sec-Fetch-Dest: empty
                                                      Referer: https://accounts.google.com/
                                                      Accept-Encoding: gzip, deflate, br
                                                      Accept-Language: en-US,en;q=0.9
                                                      Cookie: NID=518=UwKxF1J0Ty-rCTFpiJigHwx9qSYUjdENylT2S5EBu-d7HIQNmkiBrs4abkKIikW5MuMg8y8ds6lU-LU8nv4jiRSmeAnRyNtpYQ1RYL_SOj8r5MNcOIINVzxGlKqjlDWV01cqxRWVKHaXdZjqwunWYK87d5fkyKvT0B_we7awexcXtsvmvVa4I2zfww
                                                      2024-10-07 11:24:19 UTC1159OUTData Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 33 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 32 38 33 30 30 32 35 38 33 37 32 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c
                                                      Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"31",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],1828,[["1728300258372",null,null,null
                                                      2024-10-07 11:24:20 UTC523INHTTP/1.1 200 OK
                                                      Access-Control-Allow-Origin: https://accounts.google.com
                                                      Cross-Origin-Resource-Policy: cross-origin
                                                      Access-Control-Allow-Credentials: true
                                                      Access-Control-Allow-Headers: X-Playlog-Web
                                                      Content-Type: text/plain; charset=UTF-8
                                                      Date: Mon, 07 Oct 2024 11:24:20 GMT
                                                      Server: Playlog
                                                      Cache-Control: private
                                                      X-XSS-Protection: 0
                                                      X-Frame-Options: SAMEORIGIN
                                                      Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                      Accept-Ranges: none
                                                      Vary: Accept-Encoding
                                                      Connection: close
                                                      Transfer-Encoding: chunked
                                                      2024-10-07 11:24:20 UTC137INData Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a
                                                      Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
                                                      2024-10-07 11:24:20 UTC5INData Raw: 30 0d 0a 0d 0a
                                                      Data Ascii: 0


                                                      Statistics

                                                      CPU Usage

                                                      Click to jump to process

                                                      Memory Usage

                                                      Click to jump to process

                                                      High Level Behavior Distribution

                                                      Click to dive into process behavior distribution

                                                      Behavior

                                                      Click to jump to process

                                                      System Behavior

                                                      General

                                                      Target ID:0
                                                      Start time:07:23:00
                                                      Start date:07/10/2024
                                                      Path:C:\Users\user\Desktop\file.exe
                                                      Wow64 process (32bit):true
                                                      Commandline:"C:\Users\user\Desktop\file.exe"
                                                      Imagebase:0xeb0000
                                                      File size:919'040 bytes
                                                      MD5 hash:6D09B95CC7D01AFE4997AF5E6E550580
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Reputation:low
                                                      Has exited:true

                                                      General

                                                      Target ID:1
                                                      Start time:07:23:00
                                                      Start date:07/10/2024
                                                      Path:C:\Windows\SysWOW64\taskkill.exe
                                                      Wow64 process (32bit):true
                                                      Commandline:taskkill /F /IM chrome.exe /T
                                                      Imagebase:0x7d0000
                                                      File size:74'240 bytes
                                                      MD5 hash:CA313FD7E6C2A778FFD21CFB5C1C56CD
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Reputation:high
                                                      Has exited:true

                                                      General

                                                      Target ID:2
                                                      Start time:07:23:00
                                                      Start date:07/10/2024
                                                      Path:C:\Windows\System32\conhost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                      Imagebase:0x7ff7699e0000
                                                      File size:862'208 bytes
                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Reputation:high
                                                      Has exited:true

                                                      General

                                                      Target ID:3
                                                      Start time:07:23:00
                                                      Start date:07/10/2024
                                                      Path:C:\Windows\SysWOW64\taskkill.exe
                                                      Wow64 process (32bit):true
                                                      Commandline:taskkill /F /IM msedge.exe /T
                                                      Imagebase:0x7d0000
                                                      File size:74'240 bytes
                                                      MD5 hash:CA313FD7E6C2A778FFD21CFB5C1C56CD
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Reputation:high
                                                      Has exited:true

                                                      General

                                                      Target ID:4
                                                      Start time:07:23:00
                                                      Start date:07/10/2024
                                                      Path:C:\Windows\System32\conhost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                      Imagebase:0x7ff7699e0000
                                                      File size:862'208 bytes
                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Reputation:high
                                                      Has exited:true

                                                      General

                                                      Target ID:5
                                                      Start time:07:23:00
                                                      Start date:07/10/2024
                                                      Path:C:\Windows\SysWOW64\taskkill.exe
                                                      Wow64 process (32bit):true
                                                      Commandline:taskkill /F /IM firefox.exe /T
                                                      Imagebase:0x7d0000
                                                      File size:74'240 bytes
                                                      MD5 hash:CA313FD7E6C2A778FFD21CFB5C1C56CD
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Reputation:high
                                                      Has exited:true

                                                      General

                                                      Target ID:6
                                                      Start time:07:23:00
                                                      Start date:07/10/2024
                                                      Path:C:\Windows\System32\conhost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                      Imagebase:0x7ff7699e0000
                                                      File size:862'208 bytes
                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Reputation:high
                                                      Has exited:true

                                                      General

                                                      Target ID:7
                                                      Start time:07:23:00
                                                      Start date:07/10/2024
                                                      Path:C:\Windows\SysWOW64\taskkill.exe
                                                      Wow64 process (32bit):true
                                                      Commandline:taskkill /F /IM opera.exe /T
                                                      Imagebase:0x7d0000
                                                      File size:74'240 bytes
                                                      MD5 hash:CA313FD7E6C2A778FFD21CFB5C1C56CD
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Reputation:high
                                                      Has exited:true

                                                      General

                                                      Target ID:8
                                                      Start time:07:23:00
                                                      Start date:07/10/2024
                                                      Path:C:\Windows\System32\conhost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                      Imagebase:0x7ff7699e0000
                                                      File size:862'208 bytes
                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Reputation:high
                                                      Has exited:true

                                                      General

                                                      Target ID:9
                                                      Start time:07:23:01
                                                      Start date:07/10/2024
                                                      Path:C:\Windows\SysWOW64\taskkill.exe
                                                      Wow64 process (32bit):true
                                                      Commandline:taskkill /F /IM brave.exe /T
                                                      Imagebase:0x7d0000
                                                      File size:74'240 bytes
                                                      MD5 hash:CA313FD7E6C2A778FFD21CFB5C1C56CD
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Reputation:high
                                                      Has exited:true

                                                      General

                                                      Target ID:10
                                                      Start time:07:23:01
                                                      Start date:07/10/2024
                                                      Path:C:\Windows\System32\conhost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                      Imagebase:0x7ff7699e0000
                                                      File size:862'208 bytes
                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Reputation:high
                                                      Has exited:true

                                                      General

                                                      Target ID:11
                                                      Start time:07:23:02
                                                      Start date:07/10/2024
                                                      Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars
                                                      Imagebase:0x7ff76e190000
                                                      File size:3'242'272 bytes
                                                      MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Has exited:false

                                                      General

                                                      Target ID:13
                                                      Start time:07:23:02
                                                      Start date:07/10/2024
                                                      Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2016 --field-trial-handle=1936,i,4378290034050703555,17962560962937059959,262144 /prefetch:8
                                                      Imagebase:0x7ff76e190000
                                                      File size:3'242'272 bytes
                                                      MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Has exited:false

                                                      General

                                                      Target ID:14
                                                      Start time:07:23:14
                                                      Start date:07/10/2024
                                                      Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5500 --field-trial-handle=1936,i,4378290034050703555,17962560962937059959,262144 /prefetch:8
                                                      Imagebase:0x7ff76e190000
                                                      File size:3'242'272 bytes
                                                      MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                      Has elevated privileges:false
                                                      Has administrator privileges:false
                                                      Programmed in:C, C++ or other language
                                                      Has exited:false

                                                      General

                                                      Target ID:15
                                                      Start time:07:23:14
                                                      Start date:07/10/2024
                                                      Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 --field-trial-handle=1936,i,4378290034050703555,17962560962937059959,262144 /prefetch:8
                                                      Imagebase:0x7ff76e190000
                                                      File size:3'242'272 bytes
                                                      MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Has exited:true

                                                      Disassembly

                                                      Reset < >

                                                        Execution Graph

                                                        Execution Coverage:2.2%
                                                        Dynamic/Decrypted Code Coverage:0%
                                                        Signature Coverage:4.5%
                                                        Total number of Nodes:1646
                                                        Total number of Limit Nodes:66
                                                        execution_graph 94628 f42a55 94636 f21ebc 94628->94636 94631 f42a70 94638 f139c0 22 API calls 94631->94638 94632 f42a87 94634 f42a7c 94639 f1417d 22 API calls __fread_nolock 94634->94639 94637 f21ec3 IsWindow 94636->94637 94637->94631 94637->94632 94638->94634 94639->94632 94640 f03f75 94651 ecceb1 94640->94651 94642 f03f8b 94650 f04006 94642->94650 94718 ece300 23 API calls 94642->94718 94645 f04052 94648 f04a88 94645->94648 94720 f2359c 82 API calls __wsopen_s 94645->94720 94647 f03fe6 94647->94645 94719 f21abf 22 API calls 94647->94719 94660 ebbf40 94650->94660 94652 eccebf 94651->94652 94653 ecced2 94651->94653 94721 ebaceb 94652->94721 94655 eccf05 94653->94655 94656 ecced7 94653->94656 94657 ebaceb 23 API calls 94655->94657 94731 ecfddb 94656->94731 94659 eccec9 94657->94659 94659->94642 94755 ebadf0 94660->94755 94662 ebbf9d 94663 ebbfa9 94662->94663 94664 f004b6 94662->94664 94666 ebc01e 94663->94666 94667 f004c6 94663->94667 94783 f2359c 82 API calls __wsopen_s 94664->94783 94760 ebac91 94666->94760 94784 f2359c 82 API calls __wsopen_s 94667->94784 94670 ebc7da 94772 ecfe0b 94670->94772 94676 f004f5 94681 f0055a 94676->94681 94785 ecd217 349 API calls 94676->94785 94679 ebaf8a 22 API calls 94714 ebc039 __fread_nolock messages 94679->94714 94680 ecfddb 22 API calls 94680->94714 94717 ebc603 94681->94717 94786 f2359c 82 API calls __wsopen_s 94681->94786 94682 ecfe0b 22 API calls 94707 ebc350 __fread_nolock messages 94682->94707 94683 f17120 22 API calls 94683->94714 94684 ebc808 __fread_nolock 94684->94682 94685 f0091a 94819 f23209 23 API calls 94685->94819 94688 ebec40 349 API calls 94688->94714 94689 f008a5 94793 ebec40 94689->94793 94691 f008cf 94691->94717 94817 eba81b 41 API calls 94691->94817 94693 f00591 94787 f2359c 82 API calls __wsopen_s 94693->94787 94694 f008f6 94818 f2359c 82 API calls __wsopen_s 94694->94818 94698 ebbbe0 40 API calls 94698->94714 94700 ebc3ac 94700->94645 94701 ebc237 94703 ebc253 94701->94703 94820 eba8c7 22 API calls __fread_nolock 94701->94820 94702 ebaceb 23 API calls 94702->94714 94705 f00976 94703->94705 94710 ebc297 messages 94703->94710 94708 ebaceb 23 API calls 94705->94708 94707->94700 94782 ecce17 22 API calls messages 94707->94782 94709 f009bf 94708->94709 94709->94717 94821 f2359c 82 API calls __wsopen_s 94709->94821 94710->94709 94711 ebaceb 23 API calls 94710->94711 94712 ebc335 94711->94712 94712->94709 94713 ebc342 94712->94713 94771 eba704 22 API calls messages 94713->94771 94714->94670 94714->94676 94714->94679 94714->94680 94714->94681 94714->94683 94714->94684 94714->94685 94714->94688 94714->94689 94714->94693 94714->94694 94714->94698 94714->94701 94714->94702 94714->94709 94716 ecfe0b 22 API calls 94714->94716 94714->94717 94764 ebad81 94714->94764 94788 f17099 22 API calls __fread_nolock 94714->94788 94789 f35745 54 API calls _wcslen 94714->94789 94790 ecaa42 22 API calls messages 94714->94790 94791 f1f05c 40 API calls 94714->94791 94792 eba993 41 API calls 94714->94792 94716->94714 94717->94645 94718->94647 94719->94650 94720->94648 94722 ebacf9 94721->94722 94730 ebad2a messages 94721->94730 94723 ebad55 94722->94723 94725 ebad01 messages 94722->94725 94723->94730 94741 eba8c7 22 API calls __fread_nolock 94723->94741 94726 effa48 94725->94726 94727 ebad21 94725->94727 94725->94730 94726->94730 94742 ecce17 22 API calls messages 94726->94742 94728 effa3a VariantClear 94727->94728 94727->94730 94728->94730 94730->94659 94734 ecfde0 94731->94734 94733 ecfdfa 94733->94659 94734->94733 94736 ecfdfc 94734->94736 94743 edea0c 94734->94743 94750 ed4ead 7 API calls 2 library calls 94734->94750 94737 ed066d 94736->94737 94751 ed32a4 RaiseException 94736->94751 94752 ed32a4 RaiseException 94737->94752 94740 ed068a 94740->94659 94741->94730 94742->94730 94748 ee3820 _abort 94743->94748 94744 ee385e 94754 edf2d9 20 API calls _abort 94744->94754 94745 ee3849 RtlAllocateHeap 94747 ee385c 94745->94747 94745->94748 94747->94734 94748->94744 94748->94745 94753 ed4ead 7 API calls 2 library calls 94748->94753 94750->94734 94751->94737 94752->94740 94753->94748 94754->94747 94756 ebae01 94755->94756 94759 ebae1c messages 94755->94759 94822 ebaec9 94756->94822 94758 ebae09 CharUpperBuffW 94758->94759 94759->94662 94761 ebacae 94760->94761 94763 ebacd1 94761->94763 94828 f2359c 82 API calls __wsopen_s 94761->94828 94763->94714 94765 effadb 94764->94765 94766 ebad92 94764->94766 94767 ecfddb 22 API calls 94766->94767 94768 ebad99 94767->94768 94829 ebadcd 94768->94829 94771->94707 94775 ecfddb 94772->94775 94773 edea0c ___std_exception_copy 21 API calls 94773->94775 94774 ecfdfa 94774->94684 94775->94773 94775->94774 94778 ecfdfc 94775->94778 94842 ed4ead 7 API calls 2 library calls 94775->94842 94777 ed066d 94844 ed32a4 RaiseException 94777->94844 94778->94777 94843 ed32a4 RaiseException 94778->94843 94781 ed068a 94781->94684 94782->94707 94783->94667 94784->94717 94785->94681 94786->94717 94787->94717 94788->94714 94789->94714 94790->94714 94791->94714 94792->94714 94813 ebec76 messages 94793->94813 94794 ed0242 EnterCriticalSection LeaveCriticalSection LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 94794->94813 94795 ed01f8 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent __Init_thread_footer 94795->94813 94796 f04beb 94852 f2359c 82 API calls __wsopen_s 94796->94852 94798 ebfef7 94809 ebed9d messages 94798->94809 94848 eba8c7 22 API calls __fread_nolock 94798->94848 94799 ecfddb 22 API calls 94799->94813 94801 f04b0b 94850 f2359c 82 API calls __wsopen_s 94801->94850 94802 eba8c7 22 API calls 94802->94813 94803 f04600 94803->94809 94847 eba8c7 22 API calls __fread_nolock 94803->94847 94809->94691 94810 ebfbe3 94810->94809 94812 f04bdc 94810->94812 94816 ebf3ae messages 94810->94816 94811 eba961 22 API calls 94811->94813 94851 f2359c 82 API calls __wsopen_s 94812->94851 94813->94794 94813->94795 94813->94796 94813->94798 94813->94799 94813->94801 94813->94802 94813->94803 94813->94809 94813->94810 94813->94811 94814 ed00a3 29 API calls pre_c_initialization 94813->94814 94813->94816 94845 ec01e0 349 API calls 2 library calls 94813->94845 94846 ec06a0 41 API calls messages 94813->94846 94814->94813 94816->94809 94849 f2359c 82 API calls __wsopen_s 94816->94849 94817->94694 94818->94717 94819->94701 94820->94703 94821->94717 94823 ebaed9 __fread_nolock 94822->94823 94824 ebaedc 94822->94824 94823->94758 94825 ecfddb 22 API calls 94824->94825 94826 ebaee7 94825->94826 94827 ecfe0b 22 API calls 94826->94827 94827->94823 94828->94763 94835 ebaddd 94829->94835 94830 ebadb6 94830->94714 94831 ecfddb 22 API calls 94831->94835 94834 ebadcd 22 API calls 94834->94835 94835->94830 94835->94831 94835->94834 94836 eba961 94835->94836 94841 eba8c7 22 API calls __fread_nolock 94835->94841 94837 ecfe0b 22 API calls 94836->94837 94838 eba976 94837->94838 94839 ecfddb 22 API calls 94838->94839 94840 eba984 94839->94840 94840->94835 94841->94835 94842->94775 94843->94777 94844->94781 94845->94813 94846->94813 94847->94809 94848->94809 94849->94809 94850->94809 94851->94796 94852->94809 94853 eb1cad SystemParametersInfoW 94854 eb2de3 94855 eb2df0 __wsopen_s 94854->94855 94856 eb2e09 94855->94856 94857 ef2c2b ___scrt_fastfail 94855->94857 94870 eb3aa2 94856->94870 94859 ef2c47 GetOpenFileNameW 94857->94859 94861 ef2c96 94859->94861 94927 eb6b57 94861->94927 94866 ef2cab 94866->94866 94867 eb2e27 94898 eb44a8 94867->94898 94939 ef1f50 94870->94939 94873 eb3ae9 94945 eba6c3 94873->94945 94874 eb3ace 94875 eb6b57 22 API calls 94874->94875 94877 eb3ada 94875->94877 94941 eb37a0 94877->94941 94880 eb2da5 94881 ef1f50 __wsopen_s 94880->94881 94882 eb2db2 GetLongPathNameW 94881->94882 94883 eb6b57 22 API calls 94882->94883 94884 eb2dda 94883->94884 94885 eb3598 94884->94885 94886 eba961 22 API calls 94885->94886 94887 eb35aa 94886->94887 94888 eb3aa2 23 API calls 94887->94888 94889 eb35b5 94888->94889 94890 ef32eb 94889->94890 94891 eb35c0 94889->94891 94895 ef330d 94890->94895 94967 ecce60 41 API calls 94890->94967 94955 eb515f 94891->94955 94897 eb35df 94897->94867 94968 eb4ecb 94898->94968 94901 ef3833 94990 f22cf9 94901->94990 94903 eb4ecb 94 API calls 94905 eb44e1 94903->94905 94904 ef3848 94906 ef384c 94904->94906 94907 ef3869 94904->94907 94905->94901 94908 eb44e9 94905->94908 95017 eb4f39 94906->95017 94910 ecfe0b 22 API calls 94907->94910 94911 ef3854 94908->94911 94912 eb44f5 94908->94912 94926 ef38ae 94910->94926 95023 f1da5a 82 API calls 94911->95023 95016 eb940c 136 API calls 2 library calls 94912->95016 94915 ef3862 94915->94907 94916 eb2e31 94917 eb4f39 68 API calls 94921 ef3a5f 94917->94921 94921->94917 95029 f1989b 82 API calls __wsopen_s 94921->95029 94923 eb9cb3 22 API calls 94923->94926 94926->94921 94926->94923 95024 f1967e 22 API calls __fread_nolock 94926->95024 95025 f195ad 42 API calls _wcslen 94926->95025 95026 f20b5a 22 API calls 94926->95026 95027 eba4a1 22 API calls __fread_nolock 94926->95027 95028 eb3ff7 22 API calls 94926->95028 94928 eb6b67 _wcslen 94927->94928 94929 ef4ba1 94927->94929 94932 eb6b7d 94928->94932 94933 eb6ba2 94928->94933 94930 eb93b2 22 API calls 94929->94930 94931 ef4baa 94930->94931 94931->94931 95344 eb6f34 22 API calls 94932->95344 94935 ecfddb 22 API calls 94933->94935 94936 eb6bae 94935->94936 94938 ecfe0b 22 API calls 94936->94938 94937 eb6b85 __fread_nolock 94937->94866 94938->94937 94940 eb3aaf GetFullPathNameW 94939->94940 94940->94873 94940->94874 94942 eb37ae 94941->94942 94951 eb93b2 94942->94951 94944 eb2e12 94944->94880 94946 eba6dd 94945->94946 94950 eba6d0 94945->94950 94947 ecfddb 22 API calls 94946->94947 94948 eba6e7 94947->94948 94949 ecfe0b 22 API calls 94948->94949 94949->94950 94950->94877 94952 eb93c9 __fread_nolock 94951->94952 94953 eb93c0 94951->94953 94952->94944 94953->94952 94954 ebaec9 22 API calls 94953->94954 94954->94952 94956 eb516e 94955->94956 94960 eb518f __fread_nolock 94955->94960 94958 ecfe0b 22 API calls 94956->94958 94957 ecfddb 22 API calls 94959 eb35cc 94957->94959 94958->94960 94961 eb35f3 94959->94961 94960->94957 94962 eb3605 94961->94962 94966 eb3624 __fread_nolock 94961->94966 94964 ecfe0b 22 API calls 94962->94964 94963 ecfddb 22 API calls 94965 eb363b 94963->94965 94964->94966 94965->94897 94966->94963 94967->94890 95030 eb4e90 LoadLibraryA 94968->95030 94973 ef3ccf 94975 eb4f39 68 API calls 94973->94975 94974 eb4ef6 LoadLibraryExW 95038 eb4e59 LoadLibraryA 94974->95038 94977 ef3cd6 94975->94977 94979 eb4e59 3 API calls 94977->94979 94981 ef3cde 94979->94981 95060 eb50f5 94981->95060 94982 eb4f20 94982->94981 94983 eb4f2c 94982->94983 94984 eb4f39 68 API calls 94983->94984 94986 eb44cd 94984->94986 94986->94901 94986->94903 94989 ef3d05 94991 f22d15 94990->94991 94992 eb511f 64 API calls 94991->94992 94993 f22d29 94992->94993 95210 f22e66 94993->95210 94996 eb50f5 40 API calls 94997 f22d56 94996->94997 94998 eb50f5 40 API calls 94997->94998 94999 f22d66 94998->94999 95000 eb50f5 40 API calls 94999->95000 95001 f22d81 95000->95001 95002 eb50f5 40 API calls 95001->95002 95003 f22d9c 95002->95003 95004 eb511f 64 API calls 95003->95004 95005 f22db3 95004->95005 95006 edea0c ___std_exception_copy 21 API calls 95005->95006 95007 f22dba 95006->95007 95008 edea0c ___std_exception_copy 21 API calls 95007->95008 95009 f22dc4 95008->95009 95010 eb50f5 40 API calls 95009->95010 95011 f22dd8 95010->95011 95012 f228fe 27 API calls 95011->95012 95014 f22dee 95012->95014 95013 f22d3f 95013->94904 95014->95013 95216 f222ce 79 API calls 95014->95216 95016->94916 95018 eb4f43 95017->95018 95020 eb4f4a 95017->95020 95217 ede678 95018->95217 95021 eb4f6a FreeLibrary 95020->95021 95022 eb4f59 95020->95022 95021->95022 95022->94911 95023->94915 95024->94926 95025->94926 95026->94926 95027->94926 95028->94926 95029->94921 95031 eb4ea8 GetProcAddress 95030->95031 95032 eb4ec6 95030->95032 95033 eb4eb8 95031->95033 95035 ede5eb 95032->95035 95033->95032 95034 eb4ebf FreeLibrary 95033->95034 95034->95032 95068 ede52a 95035->95068 95037 eb4eea 95037->94973 95037->94974 95039 eb4e6e GetProcAddress 95038->95039 95040 eb4e8d 95038->95040 95041 eb4e7e 95039->95041 95043 eb4f80 95040->95043 95041->95040 95042 eb4e86 FreeLibrary 95041->95042 95042->95040 95044 ecfe0b 22 API calls 95043->95044 95045 eb4f95 95044->95045 95136 eb5722 95045->95136 95047 eb4fa1 __fread_nolock 95048 ef3d1d 95047->95048 95049 eb50a5 95047->95049 95059 eb4fdc 95047->95059 95150 f2304d 74 API calls 95048->95150 95139 eb42a2 CreateStreamOnHGlobal 95049->95139 95052 ef3d22 95054 eb511f 64 API calls 95052->95054 95053 eb50f5 40 API calls 95053->95059 95055 ef3d45 95054->95055 95056 eb50f5 40 API calls 95055->95056 95057 eb506e messages 95056->95057 95057->94982 95059->95052 95059->95053 95059->95057 95145 eb511f 95059->95145 95061 eb5107 95060->95061 95062 ef3d70 95060->95062 95172 ede8c4 95061->95172 95065 f228fe 95193 f2274e 95065->95193 95067 f22919 95067->94989 95071 ede536 BuildCatchObjectHelperInternal 95068->95071 95069 ede544 95093 edf2d9 20 API calls _abort 95069->95093 95071->95069 95073 ede574 95071->95073 95072 ede549 95094 ee27ec 26 API calls _abort 95072->95094 95075 ede579 95073->95075 95076 ede586 95073->95076 95095 edf2d9 20 API calls _abort 95075->95095 95085 ee8061 95076->95085 95079 ede58f 95080 ede595 95079->95080 95081 ede5a2 95079->95081 95096 edf2d9 20 API calls _abort 95080->95096 95097 ede5d4 LeaveCriticalSection __fread_nolock 95081->95097 95083 ede554 __fread_nolock 95083->95037 95086 ee806d BuildCatchObjectHelperInternal 95085->95086 95098 ee2f5e EnterCriticalSection 95086->95098 95088 ee807b 95099 ee80fb 95088->95099 95092 ee80ac __fread_nolock 95092->95079 95093->95072 95094->95083 95095->95083 95096->95083 95097->95083 95098->95088 95102 ee811e 95099->95102 95100 ee8177 95117 ee4c7d 95100->95117 95102->95100 95108 ee8088 95102->95108 95115 ed918d EnterCriticalSection 95102->95115 95116 ed91a1 LeaveCriticalSection 95102->95116 95106 ee8189 95106->95108 95130 ee3405 11 API calls 2 library calls 95106->95130 95112 ee80b7 95108->95112 95109 ee81a8 95131 ed918d EnterCriticalSection 95109->95131 95135 ee2fa6 LeaveCriticalSection 95112->95135 95114 ee80be 95114->95092 95115->95102 95116->95102 95122 ee4c8a _abort 95117->95122 95118 ee4cb5 RtlAllocateHeap 95120 ee4cc8 95118->95120 95118->95122 95119 ee4cca 95133 edf2d9 20 API calls _abort 95119->95133 95124 ee29c8 95120->95124 95122->95118 95122->95119 95132 ed4ead 7 API calls 2 library calls 95122->95132 95125 ee29d3 RtlFreeHeap 95124->95125 95126 ee29fc __dosmaperr 95124->95126 95125->95126 95127 ee29e8 95125->95127 95126->95106 95134 edf2d9 20 API calls _abort 95127->95134 95129 ee29ee GetLastError 95129->95126 95130->95109 95131->95108 95132->95122 95133->95120 95134->95129 95135->95114 95137 ecfddb 22 API calls 95136->95137 95138 eb5734 95137->95138 95138->95047 95140 eb42bc FindResourceExW 95139->95140 95144 eb42d9 95139->95144 95141 ef35ba LoadResource 95140->95141 95140->95144 95142 ef35cf SizeofResource 95141->95142 95141->95144 95143 ef35e3 LockResource 95142->95143 95142->95144 95143->95144 95144->95059 95146 eb512e 95145->95146 95147 ef3d90 95145->95147 95151 edece3 95146->95151 95150->95052 95154 edeaaa 95151->95154 95153 eb513c 95153->95059 95155 edeab6 BuildCatchObjectHelperInternal 95154->95155 95156 edeac2 95155->95156 95157 edeae8 95155->95157 95167 edf2d9 20 API calls _abort 95156->95167 95169 ed918d EnterCriticalSection 95157->95169 95160 edeac7 95168 ee27ec 26 API calls _abort 95160->95168 95162 edeaf4 95170 edec0a 62 API calls 2 library calls 95162->95170 95164 edeb08 95171 edeb27 LeaveCriticalSection __fread_nolock 95164->95171 95166 edead2 __fread_nolock 95166->95153 95167->95160 95168->95166 95169->95162 95170->95164 95171->95166 95175 ede8e1 95172->95175 95174 eb5118 95174->95065 95176 ede8ed BuildCatchObjectHelperInternal 95175->95176 95177 ede92d 95176->95177 95178 ede900 ___scrt_fastfail 95176->95178 95179 ede925 __fread_nolock 95176->95179 95190 ed918d EnterCriticalSection 95177->95190 95188 edf2d9 20 API calls _abort 95178->95188 95179->95174 95182 ede937 95191 ede6f8 38 API calls 4 library calls 95182->95191 95183 ede91a 95189 ee27ec 26 API calls _abort 95183->95189 95186 ede94e 95192 ede96c LeaveCriticalSection __fread_nolock 95186->95192 95188->95183 95189->95179 95190->95182 95191->95186 95192->95179 95196 ede4e8 95193->95196 95195 f2275d 95195->95067 95199 ede469 95196->95199 95198 ede505 95198->95195 95200 ede48c 95199->95200 95201 ede478 95199->95201 95206 ede488 __alldvrm 95200->95206 95209 ee333f 11 API calls 2 library calls 95200->95209 95207 edf2d9 20 API calls _abort 95201->95207 95203 ede47d 95208 ee27ec 26 API calls _abort 95203->95208 95206->95198 95207->95203 95208->95206 95209->95206 95214 f22e7a 95210->95214 95211 f228fe 27 API calls 95211->95214 95212 f22d3b 95212->94996 95212->95013 95213 eb50f5 40 API calls 95213->95214 95214->95211 95214->95212 95214->95213 95215 eb511f 64 API calls 95214->95215 95215->95214 95216->95013 95218 ede684 BuildCatchObjectHelperInternal 95217->95218 95219 ede695 95218->95219 95221 ede6aa 95218->95221 95230 edf2d9 20 API calls _abort 95219->95230 95229 ede6a5 __fread_nolock 95221->95229 95232 ed918d EnterCriticalSection 95221->95232 95222 ede69a 95231 ee27ec 26 API calls _abort 95222->95231 95225 ede6c6 95233 ede602 95225->95233 95227 ede6d1 95249 ede6ee LeaveCriticalSection __fread_nolock 95227->95249 95229->95020 95230->95222 95231->95229 95232->95225 95234 ede60f 95233->95234 95235 ede624 95233->95235 95250 edf2d9 20 API calls _abort 95234->95250 95240 ede61f 95235->95240 95252 eddc0b 95235->95252 95237 ede614 95251 ee27ec 26 API calls _abort 95237->95251 95240->95227 95245 ede646 95269 ee862f 95245->95269 95248 ee29c8 _free 20 API calls 95248->95240 95249->95229 95250->95237 95251->95240 95253 eddc1f 95252->95253 95254 eddc23 95252->95254 95258 ee4d7a 95253->95258 95254->95253 95255 edd955 __fread_nolock 26 API calls 95254->95255 95256 eddc43 95255->95256 95284 ee59be 62 API calls 5 library calls 95256->95284 95259 ede640 95258->95259 95260 ee4d90 95258->95260 95262 edd955 95259->95262 95260->95259 95261 ee29c8 _free 20 API calls 95260->95261 95261->95259 95263 edd976 95262->95263 95264 edd961 95262->95264 95263->95245 95285 edf2d9 20 API calls _abort 95264->95285 95266 edd966 95286 ee27ec 26 API calls _abort 95266->95286 95268 edd971 95268->95245 95270 ee863e 95269->95270 95271 ee8653 95269->95271 95287 edf2c6 20 API calls _abort 95270->95287 95273 ee868e 95271->95273 95278 ee867a 95271->95278 95292 edf2c6 20 API calls _abort 95273->95292 95275 ee8643 95288 edf2d9 20 API calls _abort 95275->95288 95276 ee8693 95293 edf2d9 20 API calls _abort 95276->95293 95289 ee8607 95278->95289 95281 ede64c 95281->95240 95281->95248 95282 ee869b 95294 ee27ec 26 API calls _abort 95282->95294 95284->95253 95285->95266 95286->95268 95287->95275 95288->95281 95295 ee8585 95289->95295 95291 ee862b 95291->95281 95292->95276 95293->95282 95294->95281 95296 ee8591 BuildCatchObjectHelperInternal 95295->95296 95306 ee5147 EnterCriticalSection 95296->95306 95298 ee859f 95299 ee85c6 95298->95299 95300 ee85d1 95298->95300 95307 ee86ae 95299->95307 95322 edf2d9 20 API calls _abort 95300->95322 95303 ee85cc 95323 ee85fb LeaveCriticalSection __wsopen_s 95303->95323 95305 ee85ee __fread_nolock 95305->95291 95306->95298 95324 ee53c4 95307->95324 95309 ee86c4 95337 ee5333 21 API calls 2 library calls 95309->95337 95311 ee86be 95311->95309 95312 ee86f6 95311->95312 95314 ee53c4 __wsopen_s 26 API calls 95311->95314 95312->95309 95315 ee53c4 __wsopen_s 26 API calls 95312->95315 95313 ee871c 95316 ee873e 95313->95316 95338 edf2a3 20 API calls __dosmaperr 95313->95338 95317 ee86ed 95314->95317 95318 ee8702 CloseHandle 95315->95318 95316->95303 95320 ee53c4 __wsopen_s 26 API calls 95317->95320 95318->95309 95321 ee870e GetLastError 95318->95321 95320->95312 95321->95309 95322->95303 95323->95305 95325 ee53e6 95324->95325 95326 ee53d1 95324->95326 95331 ee540b 95325->95331 95341 edf2c6 20 API calls _abort 95325->95341 95339 edf2c6 20 API calls _abort 95326->95339 95328 ee53d6 95340 edf2d9 20 API calls _abort 95328->95340 95331->95311 95332 ee5416 95342 edf2d9 20 API calls _abort 95332->95342 95333 ee53de 95333->95311 95335 ee541e 95343 ee27ec 26 API calls _abort 95335->95343 95337->95313 95338->95316 95339->95328 95340->95333 95341->95332 95342->95335 95343->95333 95344->94937 95345 ef2ba5 95346 ef2baf 95345->95346 95347 eb2b25 95345->95347 95391 eb3a5a 95346->95391 95373 eb2b83 7 API calls 95347->95373 95351 ef2bb8 95398 eb9cb3 95351->95398 95354 eb2b2f 95360 eb2b44 95354->95360 95377 eb3837 95354->95377 95355 ef2bc6 95356 ef2bce 95355->95356 95357 ef2bf5 95355->95357 95404 eb33c6 95356->95404 95358 eb33c6 22 API calls 95357->95358 95362 ef2bf1 GetForegroundWindow ShellExecuteW 95358->95362 95365 eb2b5f 95360->95365 95387 eb30f2 95360->95387 95369 ef2c26 95362->95369 95371 eb2b66 SetCurrentDirectoryW 95365->95371 95369->95365 95370 eb33c6 22 API calls 95370->95362 95372 eb2b7a 95371->95372 95422 eb2cd4 7 API calls 95373->95422 95375 eb2b2a 95376 eb2c63 CreateWindowExW CreateWindowExW ShowWindow ShowWindow 95375->95376 95376->95354 95378 eb3862 ___scrt_fastfail 95377->95378 95423 eb4212 95378->95423 95381 eb38e8 95383 ef3386 Shell_NotifyIconW 95381->95383 95384 eb3906 Shell_NotifyIconW 95381->95384 95427 eb3923 95384->95427 95386 eb391c 95386->95360 95388 eb3154 95387->95388 95389 eb3104 ___scrt_fastfail 95387->95389 95388->95365 95390 eb3123 Shell_NotifyIconW 95389->95390 95390->95388 95392 ef1f50 __wsopen_s 95391->95392 95393 eb3a67 GetModuleFileNameW 95392->95393 95394 eb9cb3 22 API calls 95393->95394 95395 eb3a8d 95394->95395 95396 eb3aa2 23 API calls 95395->95396 95397 eb3a97 95396->95397 95397->95351 95399 eb9cc2 _wcslen 95398->95399 95400 ecfe0b 22 API calls 95399->95400 95401 eb9cea __fread_nolock 95400->95401 95402 ecfddb 22 API calls 95401->95402 95403 eb9d00 95402->95403 95403->95355 95405 ef30bb 95404->95405 95406 eb33dd 95404->95406 95407 ecfddb 22 API calls 95405->95407 95456 eb33ee 95406->95456 95409 ef30c5 _wcslen 95407->95409 95411 ecfe0b 22 API calls 95409->95411 95410 eb33e8 95413 eb6350 95410->95413 95412 ef30fe __fread_nolock 95411->95412 95414 eb6362 95413->95414 95415 ef4a51 95413->95415 95471 eb6373 95414->95471 95481 eb4a88 22 API calls __fread_nolock 95415->95481 95418 eb636e 95418->95370 95419 ef4a5b 95421 ef4a67 95419->95421 95482 eba8c7 22 API calls __fread_nolock 95419->95482 95422->95375 95424 ef35a4 95423->95424 95425 eb38b7 95423->95425 95424->95425 95426 ef35ad DestroyIcon 95424->95426 95425->95381 95449 f1c874 42 API calls _strftime 95425->95449 95426->95425 95428 eb393f 95427->95428 95446 eb3a13 95427->95446 95450 eb6270 95428->95450 95431 eb395a 95433 eb6b57 22 API calls 95431->95433 95432 ef3393 LoadStringW 95434 ef33ad 95432->95434 95435 eb396f 95433->95435 95448 eb3994 ___scrt_fastfail 95434->95448 95455 eba8c7 22 API calls __fread_nolock 95434->95455 95436 ef33c9 95435->95436 95437 eb397c 95435->95437 95440 eb6350 22 API calls 95436->95440 95437->95434 95439 eb3986 95437->95439 95441 eb6350 22 API calls 95439->95441 95442 ef33d7 95440->95442 95441->95448 95443 eb33c6 22 API calls 95442->95443 95442->95448 95445 ef33f9 95443->95445 95444 eb39f9 Shell_NotifyIconW 95444->95446 95447 eb33c6 22 API calls 95445->95447 95446->95386 95447->95448 95448->95444 95449->95381 95451 ecfe0b 22 API calls 95450->95451 95452 eb6295 95451->95452 95453 ecfddb 22 API calls 95452->95453 95454 eb394d 95453->95454 95454->95431 95454->95432 95455->95448 95457 eb33fe _wcslen 95456->95457 95458 ef311d 95457->95458 95459 eb3411 95457->95459 95461 ecfddb 22 API calls 95458->95461 95466 eba587 95459->95466 95463 ef3127 95461->95463 95462 eb341e __fread_nolock 95462->95410 95464 ecfe0b 22 API calls 95463->95464 95465 ef3157 __fread_nolock 95464->95465 95467 eba59d 95466->95467 95470 eba598 __fread_nolock 95466->95470 95468 ecfe0b 22 API calls 95467->95468 95469 eff80f 95467->95469 95468->95470 95469->95469 95470->95462 95472 eb6382 95471->95472 95478 eb63b6 __fread_nolock 95471->95478 95473 ef4a82 95472->95473 95474 eb63a9 95472->95474 95472->95478 95475 ecfddb 22 API calls 95473->95475 95476 eba587 22 API calls 95474->95476 95477 ef4a91 95475->95477 95476->95478 95479 ecfe0b 22 API calls 95477->95479 95478->95418 95480 ef4ac5 __fread_nolock 95479->95480 95481->95419 95482->95421 95483 ee8402 95488 ee81be 95483->95488 95486 ee842a 95493 ee81ef try_get_first_available_module 95488->95493 95490 ee83ee 95507 ee27ec 26 API calls _abort 95490->95507 95492 ee8343 95492->95486 95500 ef0984 95492->95500 95496 ee8338 95493->95496 95503 ed8e0b 40 API calls 2 library calls 95493->95503 95495 ee838c 95495->95496 95504 ed8e0b 40 API calls 2 library calls 95495->95504 95496->95492 95506 edf2d9 20 API calls _abort 95496->95506 95498 ee83ab 95498->95496 95505 ed8e0b 40 API calls 2 library calls 95498->95505 95508 ef0081 95500->95508 95502 ef099f 95502->95486 95503->95495 95504->95498 95505->95496 95506->95490 95507->95492 95509 ef008d BuildCatchObjectHelperInternal 95508->95509 95510 ef009b 95509->95510 95512 ef00d4 95509->95512 95565 edf2d9 20 API calls _abort 95510->95565 95519 ef065b 95512->95519 95513 ef00a0 95566 ee27ec 26 API calls _abort 95513->95566 95518 ef00aa __fread_nolock 95518->95502 95520 ef0678 95519->95520 95521 ef068d 95520->95521 95522 ef06a6 95520->95522 95582 edf2c6 20 API calls _abort 95521->95582 95568 ee5221 95522->95568 95525 ef0692 95583 edf2d9 20 API calls _abort 95525->95583 95526 ef06ab 95527 ef06cb 95526->95527 95528 ef06b4 95526->95528 95581 ef039a CreateFileW 95527->95581 95584 edf2c6 20 API calls _abort 95528->95584 95532 ef06b9 95585 edf2d9 20 API calls _abort 95532->95585 95533 ef0781 GetFileType 95536 ef078c GetLastError 95533->95536 95537 ef07d3 95533->95537 95535 ef0756 GetLastError 95587 edf2a3 20 API calls __dosmaperr 95535->95587 95588 edf2a3 20 API calls __dosmaperr 95536->95588 95590 ee516a 21 API calls 2 library calls 95537->95590 95538 ef0704 95538->95533 95538->95535 95586 ef039a CreateFileW 95538->95586 95542 ef079a CloseHandle 95542->95525 95545 ef07c3 95542->95545 95544 ef0749 95544->95533 95544->95535 95589 edf2d9 20 API calls _abort 95545->95589 95547 ef07f4 95549 ef0840 95547->95549 95591 ef05ab 72 API calls 3 library calls 95547->95591 95548 ef07c8 95548->95525 95553 ef086d 95549->95553 95592 ef014d 72 API calls 4 library calls 95549->95592 95552 ef0866 95552->95553 95554 ef087e 95552->95554 95555 ee86ae __wsopen_s 29 API calls 95553->95555 95556 ef00f8 95554->95556 95557 ef08fc CloseHandle 95554->95557 95555->95556 95567 ef0121 LeaveCriticalSection __wsopen_s 95556->95567 95593 ef039a CreateFileW 95557->95593 95559 ef0927 95560 ef095d 95559->95560 95561 ef0931 GetLastError 95559->95561 95560->95556 95594 edf2a3 20 API calls __dosmaperr 95561->95594 95563 ef093d 95595 ee5333 21 API calls 2 library calls 95563->95595 95565->95513 95566->95518 95567->95518 95569 ee522d BuildCatchObjectHelperInternal 95568->95569 95596 ee2f5e EnterCriticalSection 95569->95596 95571 ee5234 95572 ee5259 95571->95572 95577 ee52c7 EnterCriticalSection 95571->95577 95579 ee527b 95571->95579 95600 ee5000 95572->95600 95575 ee52a4 __fread_nolock 95575->95526 95578 ee52d4 LeaveCriticalSection 95577->95578 95577->95579 95578->95571 95597 ee532a 95579->95597 95581->95538 95582->95525 95583->95556 95584->95532 95585->95525 95586->95544 95587->95525 95588->95542 95589->95548 95590->95547 95591->95549 95592->95552 95593->95559 95594->95563 95595->95560 95596->95571 95608 ee2fa6 LeaveCriticalSection 95597->95608 95599 ee5331 95599->95575 95601 ee4c7d _abort 20 API calls 95600->95601 95604 ee5012 95601->95604 95602 ee501f 95603 ee29c8 _free 20 API calls 95602->95603 95605 ee5071 95603->95605 95604->95602 95609 ee3405 11 API calls 2 library calls 95604->95609 95605->95579 95607 ee5147 EnterCriticalSection 95605->95607 95607->95579 95608->95599 95609->95604 95610 ef2402 95613 eb1410 95610->95613 95614 eb144f mciSendStringW 95613->95614 95615 ef24b8 DestroyWindow 95613->95615 95616 eb146b 95614->95616 95617 eb16c6 95614->95617 95628 ef24c4 95615->95628 95618 eb1479 95616->95618 95616->95628 95617->95616 95619 eb16d5 UnregisterHotKey 95617->95619 95646 eb182e 95618->95646 95619->95617 95621 ef24d8 95621->95628 95652 eb6246 CloseHandle 95621->95652 95622 ef24e2 FindClose 95622->95628 95624 ef2509 95627 ef251c FreeLibrary 95624->95627 95629 ef252d 95624->95629 95626 eb148e 95626->95629 95635 eb149c 95626->95635 95627->95624 95628->95621 95628->95622 95628->95624 95630 ef2541 VirtualFree 95629->95630 95637 eb1509 95629->95637 95630->95629 95631 eb14f8 CoUninitialize 95631->95637 95632 ef2589 95639 ef2598 messages 95632->95639 95653 f232eb 6 API calls messages 95632->95653 95633 eb1514 95636 eb1524 95633->95636 95635->95631 95650 eb1944 VirtualFreeEx CloseHandle 95636->95650 95637->95632 95637->95633 95642 ef2627 95639->95642 95654 f164d4 22 API calls messages 95639->95654 95641 eb153a 95641->95639 95643 eb161f 95641->95643 95642->95642 95643->95642 95651 eb1876 CloseHandle InternetCloseHandle InternetCloseHandle WaitForSingleObject 95643->95651 95645 eb16c1 95648 eb183b 95646->95648 95647 eb1480 95647->95624 95647->95626 95648->95647 95655 f1702a 22 API calls 95648->95655 95650->95641 95651->95645 95652->95621 95653->95632 95654->95639 95655->95648 95656 eb1044 95661 eb10f3 95656->95661 95658 eb104a 95697 ed00a3 29 API calls __onexit 95658->95697 95660 eb1054 95698 eb1398 95661->95698 95665 eb116a 95666 eba961 22 API calls 95665->95666 95667 eb1174 95666->95667 95668 eba961 22 API calls 95667->95668 95669 eb117e 95668->95669 95670 eba961 22 API calls 95669->95670 95671 eb1188 95670->95671 95672 eba961 22 API calls 95671->95672 95673 eb11c6 95672->95673 95674 eba961 22 API calls 95673->95674 95675 eb1292 95674->95675 95708 eb171c 95675->95708 95679 eb12c4 95680 eba961 22 API calls 95679->95680 95681 eb12ce 95680->95681 95729 ec1940 95681->95729 95683 eb12f9 95739 eb1aab 95683->95739 95685 eb1315 95686 eb1325 GetStdHandle 95685->95686 95687 eb137a 95686->95687 95688 ef2485 95686->95688 95691 eb1387 OleInitialize 95687->95691 95688->95687 95689 ef248e 95688->95689 95690 ecfddb 22 API calls 95689->95690 95692 ef2495 95690->95692 95691->95658 95746 f2011d InitializeCriticalSectionAndSpinCount InterlockedExchange GetCurrentProcess GetCurrentProcess DuplicateHandle 95692->95746 95694 ef249e 95747 f20944 CreateThread 95694->95747 95696 ef24aa CloseHandle 95696->95687 95697->95660 95748 eb13f1 95698->95748 95701 eb13f1 22 API calls 95702 eb13d0 95701->95702 95703 eba961 22 API calls 95702->95703 95704 eb13dc 95703->95704 95705 eb6b57 22 API calls 95704->95705 95706 eb1129 95705->95706 95707 eb1bc3 6 API calls 95706->95707 95707->95665 95709 eba961 22 API calls 95708->95709 95710 eb172c 95709->95710 95711 eba961 22 API calls 95710->95711 95712 eb1734 95711->95712 95713 eba961 22 API calls 95712->95713 95714 eb174f 95713->95714 95715 ecfddb 22 API calls 95714->95715 95716 eb129c 95715->95716 95717 eb1b4a 95716->95717 95718 eb1b58 95717->95718 95719 eba961 22 API calls 95718->95719 95720 eb1b63 95719->95720 95721 eba961 22 API calls 95720->95721 95722 eb1b6e 95721->95722 95723 eba961 22 API calls 95722->95723 95724 eb1b79 95723->95724 95725 eba961 22 API calls 95724->95725 95726 eb1b84 95725->95726 95727 ecfddb 22 API calls 95726->95727 95728 eb1b96 RegisterWindowMessageW 95727->95728 95728->95679 95730 ec1981 95729->95730 95731 ec195d 95729->95731 95755 ed0242 5 API calls __Init_thread_wait 95730->95755 95732 ec196e 95731->95732 95757 ed0242 5 API calls __Init_thread_wait 95731->95757 95732->95683 95734 ec198b 95734->95731 95756 ed01f8 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 95734->95756 95736 ec8727 95736->95732 95758 ed01f8 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 95736->95758 95740 eb1abb 95739->95740 95741 ef272d 95739->95741 95742 ecfddb 22 API calls 95740->95742 95759 f23209 23 API calls 95741->95759 95744 eb1ac3 95742->95744 95744->95685 95745 ef2738 95746->95694 95747->95696 95760 f2092a 28 API calls 95747->95760 95749 eba961 22 API calls 95748->95749 95750 eb13fc 95749->95750 95751 eba961 22 API calls 95750->95751 95752 eb1404 95751->95752 95753 eba961 22 API calls 95752->95753 95754 eb13c6 95753->95754 95754->95701 95755->95734 95756->95731 95757->95736 95758->95732 95759->95745 95761 eb105b 95766 eb344d 95761->95766 95763 eb106a 95797 ed00a3 29 API calls __onexit 95763->95797 95765 eb1074 95767 eb345d __wsopen_s 95766->95767 95768 eba961 22 API calls 95767->95768 95769 eb3513 95768->95769 95770 eb3a5a 24 API calls 95769->95770 95771 eb351c 95770->95771 95798 eb3357 95771->95798 95774 eb33c6 22 API calls 95775 eb3535 95774->95775 95776 eb515f 22 API calls 95775->95776 95777 eb3544 95776->95777 95778 eba961 22 API calls 95777->95778 95779 eb354d 95778->95779 95780 eba6c3 22 API calls 95779->95780 95781 eb3556 RegOpenKeyExW 95780->95781 95782 ef3176 RegQueryValueExW 95781->95782 95786 eb3578 95781->95786 95783 ef320c RegCloseKey 95782->95783 95784 ef3193 95782->95784 95783->95786 95795 ef321e _wcslen 95783->95795 95785 ecfe0b 22 API calls 95784->95785 95787 ef31ac 95785->95787 95786->95763 95788 eb5722 22 API calls 95787->95788 95789 ef31b7 RegQueryValueExW 95788->95789 95791 ef31d4 95789->95791 95793 ef31ee messages 95789->95793 95790 eb4c6d 22 API calls 95790->95795 95792 eb6b57 22 API calls 95791->95792 95792->95793 95793->95783 95794 eb9cb3 22 API calls 95794->95795 95795->95786 95795->95790 95795->95794 95796 eb515f 22 API calls 95795->95796 95796->95795 95797->95765 95799 ef1f50 __wsopen_s 95798->95799 95800 eb3364 GetFullPathNameW 95799->95800 95801 eb3386 95800->95801 95802 eb6b57 22 API calls 95801->95802 95803 eb33a4 95802->95803 95803->95774 95804 f02a00 95805 ebd7b0 messages 95804->95805 95806 ebdb11 PeekMessageW 95805->95806 95807 ebd807 GetInputState 95805->95807 95808 f01cbe TranslateAcceleratorW 95805->95808 95810 ebdb8f PeekMessageW 95805->95810 95811 ebda04 timeGetTime 95805->95811 95812 ebdb73 TranslateMessage DispatchMessageW 95805->95812 95813 ebdbaf Sleep 95805->95813 95814 f02b74 Sleep 95805->95814 95816 f01dda timeGetTime 95805->95816 95824 f429bf GetForegroundWindow 95805->95824 95825 ebd9d5 95805->95825 95827 f02aea 95805->95827 95832 ebec40 349 API calls 95805->95832 95834 ebbf40 349 API calls 95805->95834 95836 ebdd50 95805->95836 95843 ec1310 95805->95843 95899 ecedf6 95805->95899 95904 ebdfd0 349 API calls 3 library calls 95805->95904 95905 ece551 timeGetTime 95805->95905 95907 f23a2a 23 API calls 95805->95907 95908 f2359c 82 API calls __wsopen_s 95805->95908 95806->95805 95807->95805 95807->95806 95808->95805 95810->95805 95811->95805 95812->95810 95813->95805 95814->95827 95906 ece300 23 API calls 95816->95906 95820 f02c0b GetExitCodeProcess 95822 f02c21 WaitForSingleObject 95820->95822 95823 f02c37 CloseHandle 95820->95823 95822->95805 95822->95823 95823->95827 95824->95805 95826 f02ca9 Sleep 95826->95805 95827->95805 95827->95820 95827->95825 95827->95826 95909 f35658 23 API calls 95827->95909 95910 f1e97b QueryPerformanceCounter QueryPerformanceFrequency Sleep QueryPerformanceCounter Sleep 95827->95910 95911 ece551 timeGetTime 95827->95911 95912 f1d4dc 47 API calls 95827->95912 95832->95805 95834->95805 95837 ebdd6f 95836->95837 95838 ebdd83 95836->95838 95913 ebd260 95837->95913 95945 f2359c 82 API calls __wsopen_s 95838->95945 95840 ebdd7a 95840->95805 95842 f02f75 95842->95842 95844 ec1376 95843->95844 95845 ec17b0 95843->95845 95846 f06331 95844->95846 95847 ec1390 95844->95847 96001 ed0242 5 API calls __Init_thread_wait 95845->96001 95850 f0633d 95846->95850 96005 f3709c 349 API calls 95846->96005 95849 ec1940 9 API calls 95847->95849 95853 ec13a0 95849->95853 95850->95805 95852 ec17ba 95854 ec17fb 95852->95854 95855 eb9cb3 22 API calls 95852->95855 95856 ec1940 9 API calls 95853->95856 95858 f06346 95854->95858 95860 ec182c 95854->95860 95863 ec17d4 95855->95863 95857 ec13b6 95856->95857 95857->95854 95859 ec13ec 95857->95859 96006 f2359c 82 API calls __wsopen_s 95858->96006 95859->95858 95866 ec1408 __fread_nolock 95859->95866 95862 ebaceb 23 API calls 95860->95862 95865 ec1839 95862->95865 96002 ed01f8 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 95863->96002 95864 ec15c7 messages 95870 ec1872 95864->95870 95884 ec167b messages 95864->95884 95886 ec1940 9 API calls 95864->95886 95953 f419bc 95864->95953 95956 f429bf 95864->95956 95960 ecf645 95864->95960 95967 f3a67c CreateToolhelp32Snapshot Process32FirstW 95864->95967 95987 f3abf7 95864->95987 95992 f3ab67 95864->95992 95995 f25c5a 95864->95995 96011 f2359c 82 API calls __wsopen_s 95864->96011 96003 ecd217 349 API calls 95865->96003 95866->95864 95866->95865 95869 f0636e 95866->95869 95876 ecfddb 22 API calls 95866->95876 95877 ecfe0b 22 API calls 95866->95877 95883 ebec40 349 API calls 95866->95883 95885 ec152f 95866->95885 95889 f063b2 95866->95889 96007 f2359c 82 API calls __wsopen_s 95869->96007 96004 ecfaeb 23 API calls 95870->96004 95872 ec153c 95875 ec1940 9 API calls 95872->95875 95873 f063d1 96009 f35745 54 API calls _wcslen 95873->96009 95878 ec1549 95875->95878 95876->95866 95877->95866 95878->95864 95881 ec1940 9 API calls 95878->95881 95880 ec171d 95880->95805 95888 ec1563 95881->95888 95883->95866 95884->95880 96000 ecce17 22 API calls messages 95884->96000 95885->95872 95885->95873 95886->95864 95888->95864 96010 eba8c7 22 API calls __fread_nolock 95888->96010 96008 f2359c 82 API calls __wsopen_s 95889->96008 95900 ecee09 95899->95900 95901 ecee12 95899->95901 95900->95805 95901->95900 95902 ecee36 IsDialogMessageW 95901->95902 95903 f0efaf GetClassLongW 95901->95903 95902->95900 95902->95901 95903->95901 95903->95902 95904->95805 95905->95805 95906->95805 95907->95805 95908->95805 95909->95827 95910->95827 95911->95827 95912->95827 95914 ebec40 349 API calls 95913->95914 95933 ebd29d 95914->95933 95915 f01bc4 95952 f2359c 82 API calls __wsopen_s 95915->95952 95917 ebd6d5 95919 ebd30b messages 95917->95919 95928 ecfe0b 22 API calls 95917->95928 95918 ebd3c3 95918->95917 95921 ebd3ce 95918->95921 95919->95840 95920 ebd5ff 95922 f01bb5 95920->95922 95923 ebd614 95920->95923 95925 ecfddb 22 API calls 95921->95925 95951 f35705 23 API calls 95922->95951 95927 ecfddb 22 API calls 95923->95927 95924 ebd4b8 95929 ecfe0b 22 API calls 95924->95929 95934 ebd3d5 __fread_nolock 95925->95934 95937 ebd46a 95927->95937 95928->95934 95940 ebd429 __fread_nolock messages 95929->95940 95930 ecfddb 22 API calls 95932 ebd3f6 95930->95932 95931 ecfddb 22 API calls 95931->95933 95932->95940 95946 ebbec0 349 API calls 95932->95946 95933->95915 95933->95917 95933->95918 95933->95919 95933->95924 95933->95931 95933->95940 95934->95930 95934->95932 95936 f01ba4 95950 f2359c 82 API calls __wsopen_s 95936->95950 95937->95840 95940->95920 95940->95936 95940->95937 95941 f01b7f 95940->95941 95943 f01b5d 95940->95943 95947 eb1f6f 349 API calls 95940->95947 95949 f2359c 82 API calls __wsopen_s 95941->95949 95948 f2359c 82 API calls __wsopen_s 95943->95948 95945->95842 95946->95940 95947->95940 95948->95937 95949->95937 95950->95937 95951->95915 95952->95919 96012 f42ad8 95953->96012 95955 f419cb 95955->95864 95957 f429cb 95956->95957 95958 f42a01 GetForegroundWindow 95957->95958 95959 f429d1 95957->95959 95958->95959 95959->95864 96050 ebb567 95960->96050 95962 ecf659 95963 f0f2dc Sleep 95962->95963 95964 ecf661 timeGetTime 95962->95964 95965 ebb567 39 API calls 95964->95965 95966 ecf677 95965->95966 95966->95864 95975 f3a6c3 95967->95975 95968 eba961 22 API calls 95968->95975 95969 eb9cb3 22 API calls 95969->95975 95971 eb6350 22 API calls 95971->95975 95972 eb7510 53 API calls 95972->95975 95975->95968 95975->95969 95975->95971 95975->95972 95976 f3a796 Process32NextW 95975->95976 96056 eb525f 95975->96056 96104 ecce60 41 API calls 95975->96104 96105 f3b574 22 API calls __fread_nolock 95975->96105 95976->95975 95977 f3a7aa CloseHandle 95976->95977 96098 eb63eb 95977->96098 95981 f3a7cd 96107 ec04f0 22 API calls 95981->96107 95983 f3a87d 95983->95864 95985 ec04f0 22 API calls 95986 f3a7d9 95985->95986 95986->95983 95986->95985 96108 eb62b5 22 API calls 95986->96108 96133 f3aff9 95987->96133 95989 f3ac54 95989->95864 95990 f3ac0c 95990->95989 95991 ebaceb 23 API calls 95990->95991 95991->95989 95993 f3aff9 217 API calls 95992->95993 95994 f3ab79 95993->95994 95994->95864 95996 eb7510 53 API calls 95995->95996 95997 f25c6d 95996->95997 96255 f1dbbe lstrlenW 95997->96255 95999 f25c77 95999->95864 96000->95884 96001->95852 96002->95854 96003->95870 96004->95870 96005->95850 96006->95864 96007->95864 96008->95864 96009->95888 96010->95864 96011->95864 96013 ebaceb 23 API calls 96012->96013 96014 f42af3 96013->96014 96015 f42b1d 96014->96015 96016 f42aff 96014->96016 96018 eb6b57 22 API calls 96015->96018 96022 eb7510 96016->96022 96020 f42b1b 96018->96020 96020->95955 96023 eb7525 96022->96023 96039 eb7522 96022->96039 96024 eb752d 96023->96024 96027 eb755b 96023->96027 96046 ed51c6 26 API calls 96024->96046 96026 ef50f6 96049 ed5183 26 API calls 96026->96049 96027->96026 96030 eb756d 96027->96030 96035 ef500f 96027->96035 96028 eb753d 96034 ecfddb 22 API calls 96028->96034 96047 ecfb21 51 API calls 96030->96047 96032 ef510e 96032->96032 96036 eb7547 96034->96036 96038 ecfe0b 22 API calls 96035->96038 96044 ef5088 96035->96044 96037 eb9cb3 22 API calls 96036->96037 96037->96039 96041 ef5058 96038->96041 96039->96020 96045 eba8c7 22 API calls __fread_nolock 96039->96045 96040 ecfddb 22 API calls 96042 ef507f 96040->96042 96041->96040 96043 eb9cb3 22 API calls 96042->96043 96043->96044 96048 ecfb21 51 API calls 96044->96048 96045->96020 96046->96028 96047->96028 96048->96026 96049->96032 96051 ebb578 96050->96051 96052 ebb57f 96050->96052 96051->96052 96055 ed62d1 39 API calls 96051->96055 96052->95962 96054 ebb5c2 96054->95962 96055->96054 96057 eba961 22 API calls 96056->96057 96058 eb5275 96057->96058 96059 eba961 22 API calls 96058->96059 96060 eb527d 96059->96060 96061 eba961 22 API calls 96060->96061 96062 eb5285 96061->96062 96063 eba961 22 API calls 96062->96063 96064 eb528d 96063->96064 96065 ef3df5 96064->96065 96066 eb52c1 96064->96066 96127 eba8c7 22 API calls __fread_nolock 96065->96127 96068 eb6d25 22 API calls 96066->96068 96070 eb52cf 96068->96070 96069 ef3dfe 96071 eba6c3 22 API calls 96069->96071 96072 eb93b2 22 API calls 96070->96072 96073 eb5304 96071->96073 96074 eb52d9 96072->96074 96076 eb5325 96073->96076 96090 eb5349 96073->96090 96093 ef3e20 96073->96093 96074->96073 96075 eb6d25 22 API calls 96074->96075 96078 eb52fa 96075->96078 96076->96090 96122 eb4c6d 96076->96122 96080 eb93b2 22 API calls 96078->96080 96079 eb535a 96082 eb5370 96079->96082 96125 eba8c7 22 API calls __fread_nolock 96079->96125 96080->96073 96083 eb5384 96082->96083 96126 eba8c7 22 API calls __fread_nolock 96082->96126 96086 eb538f 96083->96086 96129 eba8c7 22 API calls __fread_nolock 96083->96129 96085 eb6b57 22 API calls 96095 ef3ee0 96085->96095 96097 eb539a 96086->96097 96130 eba8c7 22 API calls __fread_nolock 96086->96130 96089 eb6d25 22 API calls 96089->96090 96109 eb6d25 96090->96109 96093->96085 96094 eb4c6d 22 API calls 96094->96095 96095->96090 96095->96094 96128 eb49bd 22 API calls __fread_nolock 96095->96128 96097->95975 96099 eb63f3 96098->96099 96100 ecfddb 22 API calls 96099->96100 96101 eb6401 96100->96101 96132 eb6a26 22 API calls 96101->96132 96103 eb6409 96106 eb6a50 22 API calls 96103->96106 96104->95975 96105->95975 96106->95981 96107->95986 96108->95986 96110 eb6d91 96109->96110 96111 eb6d34 96109->96111 96112 eb93b2 22 API calls 96110->96112 96111->96110 96113 eb6d3f 96111->96113 96119 eb6d62 __fread_nolock 96112->96119 96114 eb6d5a 96113->96114 96115 ef4c9d 96113->96115 96131 eb6f34 22 API calls 96114->96131 96116 ecfddb 22 API calls 96115->96116 96118 ef4ca7 96116->96118 96120 ecfe0b 22 API calls 96118->96120 96119->96079 96121 ef4cda 96120->96121 96123 ebaec9 22 API calls 96122->96123 96124 eb4c78 96123->96124 96124->96089 96124->96090 96125->96082 96126->96083 96127->96069 96128->96095 96129->96086 96130->96097 96131->96119 96132->96103 96134 f3b01d ___scrt_fastfail 96133->96134 96135 f3b094 96134->96135 96136 f3b058 96134->96136 96139 ebb567 39 API calls 96135->96139 96149 f3b08b 96135->96149 96137 ebb567 39 API calls 96136->96137 96138 f3b063 96137->96138 96142 ebb567 39 API calls 96138->96142 96138->96149 96141 f3b0a5 96139->96141 96140 eb7510 53 API calls 96144 f3b10b 96140->96144 96145 ebb567 39 API calls 96141->96145 96146 f3b078 96142->96146 96143 ebb567 39 API calls 96147 f3b0ed 96143->96147 96224 eb7620 96144->96224 96145->96149 96150 ebb567 39 API calls 96146->96150 96147->96140 96149->96143 96149->96147 96150->96149 96151 f3b115 96152 f3b1d8 96151->96152 96153 f3b11f 96151->96153 96155 f3b20a GetCurrentDirectoryW 96152->96155 96158 eb7510 53 API calls 96152->96158 96154 eb7510 53 API calls 96153->96154 96156 f3b130 96154->96156 96157 ecfe0b 22 API calls 96155->96157 96159 eb7620 22 API calls 96156->96159 96160 f3b22f GetCurrentDirectoryW 96157->96160 96161 f3b1ef 96158->96161 96162 f3b13a 96159->96162 96163 f3b23c 96160->96163 96164 eb7620 22 API calls 96161->96164 96165 eb7510 53 API calls 96162->96165 96168 f3b275 96163->96168 96231 eb9c6e 22 API calls 96163->96231 96166 f3b1f9 _wcslen 96164->96166 96167 f3b14b 96165->96167 96166->96155 96166->96168 96169 eb7620 22 API calls 96167->96169 96175 f3b287 96168->96175 96176 f3b28b 96168->96176 96171 f3b155 96169->96171 96173 eb7510 53 API calls 96171->96173 96172 f3b255 96232 eb9c6e 22 API calls 96172->96232 96178 f3b166 96173->96178 96181 f3b39a CreateProcessW 96175->96181 96182 f3b2f8 96175->96182 96234 f207c0 10 API calls 96176->96234 96183 eb7620 22 API calls 96178->96183 96179 f3b265 96233 eb9c6e 22 API calls 96179->96233 96180 f3b294 96235 f206e6 10 API calls 96180->96235 96223 f3b32f _wcslen 96181->96223 96237 f111c8 39 API calls 96182->96237 96187 f3b170 96183->96187 96190 f3b1a6 GetSystemDirectoryW 96187->96190 96195 eb7510 53 API calls 96187->96195 96188 f3b2aa 96236 f205a7 8 API calls 96188->96236 96189 f3b2fd 96193 f3b323 96189->96193 96194 f3b32a 96189->96194 96192 ecfe0b 22 API calls 96190->96192 96198 f3b1cb GetSystemDirectoryW 96192->96198 96238 f11201 128 API calls 2 library calls 96193->96238 96239 f114ce 6 API calls 96194->96239 96200 f3b187 96195->96200 96197 f3b2d0 96197->96175 96198->96163 96201 eb7620 22 API calls 96200->96201 96203 f3b191 _wcslen 96201->96203 96202 f3b328 96202->96223 96203->96163 96203->96190 96204 f3b3d6 GetLastError 96213 f3b41a 96204->96213 96205 f3b42f CloseHandle 96206 f3b43f 96205->96206 96214 f3b49a 96205->96214 96207 f3b451 96206->96207 96208 f3b446 CloseHandle 96206->96208 96211 f3b463 96207->96211 96212 f3b458 CloseHandle 96207->96212 96208->96207 96210 f3b4a6 96210->96213 96215 f3b475 96211->96215 96216 f3b46a CloseHandle 96211->96216 96212->96211 96228 f20175 96213->96228 96214->96210 96219 f3b4d2 CloseHandle 96214->96219 96240 f209d9 34 API calls 96215->96240 96216->96215 96219->96213 96221 f3b486 96241 f3b536 25 API calls 96221->96241 96223->96204 96223->96205 96225 eb762a _wcslen 96224->96225 96226 ecfe0b 22 API calls 96225->96226 96227 eb763f 96226->96227 96227->96151 96242 f2030f 96228->96242 96231->96172 96232->96179 96233->96168 96234->96180 96235->96188 96236->96197 96237->96189 96238->96202 96239->96223 96240->96221 96241->96214 96243 f20321 CloseHandle 96242->96243 96244 f20329 96242->96244 96243->96244 96245 f20336 96244->96245 96246 f2032e CloseHandle 96244->96246 96247 f20343 96245->96247 96248 f2033b CloseHandle 96245->96248 96246->96245 96249 f20350 96247->96249 96250 f20348 CloseHandle 96247->96250 96248->96247 96251 f20355 CloseHandle 96249->96251 96252 f2035d 96249->96252 96250->96249 96251->96252 96253 f20362 CloseHandle 96252->96253 96254 f2017d 96252->96254 96253->96254 96254->95990 96256 f1dc06 96255->96256 96257 f1dbdc GetFileAttributesW 96255->96257 96256->95999 96257->96256 96258 f1dbe8 FindFirstFileW 96257->96258 96258->96256 96259 f1dbf9 FindClose 96258->96259 96259->96256 96260 eb1098 96265 eb42de 96260->96265 96264 eb10a7 96266 eba961 22 API calls 96265->96266 96267 eb42f5 GetVersionExW 96266->96267 96268 eb6b57 22 API calls 96267->96268 96269 eb4342 96268->96269 96270 eb93b2 22 API calls 96269->96270 96282 eb4378 96269->96282 96271 eb436c 96270->96271 96273 eb37a0 22 API calls 96271->96273 96272 eb441b GetCurrentProcess IsWow64Process 96274 eb4437 96272->96274 96273->96282 96275 eb444f LoadLibraryA 96274->96275 96276 ef3824 GetSystemInfo 96274->96276 96277 eb449c GetSystemInfo 96275->96277 96278 eb4460 GetProcAddress 96275->96278 96281 eb4476 96277->96281 96278->96277 96280 eb4470 GetNativeSystemInfo 96278->96280 96279 ef37df 96280->96281 96283 eb447a FreeLibrary 96281->96283 96284 eb109d 96281->96284 96282->96272 96282->96279 96283->96284 96285 ed00a3 29 API calls __onexit 96284->96285 96285->96264 96286 ebf7bf 96287 ebf7d3 96286->96287 96288 ebfcb6 96286->96288 96290 ebfcc2 96287->96290 96291 ecfddb 22 API calls 96287->96291 96289 ebaceb 23 API calls 96288->96289 96289->96290 96292 ebaceb 23 API calls 96290->96292 96293 ebf7e5 96291->96293 96295 ebfd3d 96292->96295 96293->96290 96294 ebf83e 96293->96294 96293->96295 96297 ec1310 349 API calls 96294->96297 96320 ebed9d messages 96294->96320 96323 f21155 22 API calls 96295->96323 96318 ebec76 messages 96297->96318 96298 ecfddb 22 API calls 96298->96318 96300 ebfef7 96300->96320 96325 eba8c7 22 API calls __fread_nolock 96300->96325 96302 f04b0b 96327 f2359c 82 API calls __wsopen_s 96302->96327 96303 eba8c7 22 API calls 96303->96318 96304 f04600 96304->96320 96324 eba8c7 22 API calls __fread_nolock 96304->96324 96310 ebfbe3 96312 f04bdc 96310->96312 96319 ebf3ae messages 96310->96319 96310->96320 96311 eba961 22 API calls 96311->96318 96328 f2359c 82 API calls __wsopen_s 96312->96328 96313 ed00a3 29 API calls pre_c_initialization 96313->96318 96315 ed0242 EnterCriticalSection LeaveCriticalSection LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 96315->96318 96316 f04beb 96329 f2359c 82 API calls __wsopen_s 96316->96329 96317 ed01f8 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent __Init_thread_footer 96317->96318 96318->96298 96318->96300 96318->96302 96318->96303 96318->96304 96318->96310 96318->96311 96318->96313 96318->96315 96318->96316 96318->96317 96318->96319 96318->96320 96321 ec01e0 349 API calls 2 library calls 96318->96321 96322 ec06a0 41 API calls messages 96318->96322 96319->96320 96326 f2359c 82 API calls __wsopen_s 96319->96326 96321->96318 96322->96318 96323->96320 96324->96320 96325->96320 96326->96320 96327->96320 96328->96316 96329->96320 96330 ed03fb 96331 ed0407 BuildCatchObjectHelperInternal 96330->96331 96359 ecfeb1 96331->96359 96333 ed040e 96334 ed0561 96333->96334 96338 ed0438 96333->96338 96389 ed083f IsProcessorFeaturePresent IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter ___scrt_fastfail 96334->96389 96336 ed0568 96382 ed4e52 96336->96382 96346 ed0477 ___scrt_is_nonwritable_in_current_image ___scrt_release_startup_lock 96338->96346 96370 ee247d 96338->96370 96344 ed0457 96350 ed04d8 96346->96350 96385 ed4e1a 38 API calls 2 library calls 96346->96385 96349 ed04de 96351 ed04f3 96349->96351 96378 ed0959 96350->96378 96386 ed0992 GetModuleHandleW 96351->96386 96353 ed04fa 96353->96336 96354 ed04fe 96353->96354 96355 ed0507 96354->96355 96387 ed4df5 28 API calls _abort 96354->96387 96388 ed0040 13 API calls 2 library calls 96355->96388 96358 ed050f 96358->96344 96360 ecfeba 96359->96360 96391 ed0698 IsProcessorFeaturePresent 96360->96391 96362 ecfec6 96392 ed2c94 10 API calls 3 library calls 96362->96392 96364 ecfecb 96365 ecfecf 96364->96365 96393 ee2317 96364->96393 96365->96333 96368 ecfee6 96368->96333 96371 ee2494 96370->96371 96372 ed0a8c __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 96371->96372 96373 ed0451 96372->96373 96373->96344 96374 ee2421 96373->96374 96376 ee2450 96374->96376 96375 ed0a8c __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 96377 ee2479 96375->96377 96376->96375 96377->96346 96444 ed2340 96378->96444 96380 ed096c GetStartupInfoW 96381 ed097f 96380->96381 96381->96349 96446 ed4bcf 96382->96446 96385->96350 96386->96353 96387->96355 96388->96358 96389->96336 96391->96362 96392->96364 96397 eed1f6 96393->96397 96396 ed2cbd 8 API calls 3 library calls 96396->96365 96400 eed213 96397->96400 96401 eed20f 96397->96401 96399 ecfed8 96399->96368 96399->96396 96400->96401 96403 ee4bfb 96400->96403 96415 ed0a8c 96401->96415 96404 ee4c07 BuildCatchObjectHelperInternal 96403->96404 96422 ee2f5e EnterCriticalSection 96404->96422 96406 ee4c0e 96423 ee50af 96406->96423 96408 ee4c1d 96414 ee4c2c 96408->96414 96436 ee4a8f 29 API calls 96408->96436 96411 ee4c27 96437 ee4b45 GetStdHandle GetFileType 96411->96437 96412 ee4c3d __fread_nolock 96412->96400 96438 ee4c48 LeaveCriticalSection _abort 96414->96438 96416 ed0a95 96415->96416 96417 ed0a97 IsProcessorFeaturePresent 96415->96417 96416->96399 96419 ed0c5d 96417->96419 96443 ed0c21 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 96419->96443 96421 ed0d40 96421->96399 96422->96406 96424 ee50bb BuildCatchObjectHelperInternal 96423->96424 96425 ee50df 96424->96425 96426 ee50c8 96424->96426 96439 ee2f5e EnterCriticalSection 96425->96439 96440 edf2d9 20 API calls _abort 96426->96440 96429 ee50cd 96441 ee27ec 26 API calls _abort 96429->96441 96431 ee5117 96442 ee513e LeaveCriticalSection _abort 96431->96442 96432 ee50d7 __fread_nolock 96432->96408 96433 ee50eb 96433->96431 96435 ee5000 __wsopen_s 21 API calls 96433->96435 96435->96433 96436->96411 96437->96414 96438->96412 96439->96433 96440->96429 96441->96432 96442->96432 96443->96421 96445 ed2357 96444->96445 96445->96380 96445->96445 96447 ed4bdb _abort 96446->96447 96448 ed4bf4 96447->96448 96449 ed4be2 96447->96449 96470 ee2f5e EnterCriticalSection 96448->96470 96485 ed4d29 GetModuleHandleW 96449->96485 96452 ed4be7 96452->96448 96486 ed4d6d GetModuleHandleExW 96452->96486 96457 ed4bfb 96465 ed4c70 96457->96465 96468 ed4c99 96457->96468 96471 ee21a8 96457->96471 96458 ed4cb6 96477 ed4ce8 96458->96477 96459 ed4ce2 96494 ef1d29 5 API calls __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 96459->96494 96462 ee2421 _abort 5 API calls 96467 ed4c88 96462->96467 96463 ee2421 _abort 5 API calls 96463->96468 96465->96462 96465->96467 96467->96463 96474 ed4cd9 96468->96474 96470->96457 96495 ee1ee1 96471->96495 96514 ee2fa6 LeaveCriticalSection 96474->96514 96476 ed4cb2 96476->96458 96476->96459 96515 ee360c 96477->96515 96480 ed4d16 96483 ed4d6d _abort 8 API calls 96480->96483 96481 ed4cf6 GetPEB 96481->96480 96482 ed4d06 GetCurrentProcess TerminateProcess 96481->96482 96482->96480 96484 ed4d1e ExitProcess 96483->96484 96485->96452 96487 ed4dba 96486->96487 96488 ed4d97 GetProcAddress 96486->96488 96489 ed4dc9 96487->96489 96490 ed4dc0 FreeLibrary 96487->96490 96492 ed4dac 96488->96492 96491 ed0a8c __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 96489->96491 96490->96489 96493 ed4bf3 96491->96493 96492->96487 96493->96448 96498 ee1e90 96495->96498 96497 ee1f05 96497->96465 96499 ee1e9c BuildCatchObjectHelperInternal 96498->96499 96506 ee2f5e EnterCriticalSection 96499->96506 96501 ee1eaa 96507 ee1f31 96501->96507 96505 ee1ec8 __fread_nolock 96505->96497 96506->96501 96508 ee1f51 96507->96508 96511 ee1f59 96507->96511 96509 ed0a8c __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 96508->96509 96510 ee1eb7 96509->96510 96513 ee1ed5 LeaveCriticalSection _abort 96510->96513 96511->96508 96512 ee29c8 _free 20 API calls 96511->96512 96512->96508 96513->96505 96514->96476 96516 ee3627 96515->96516 96517 ee3631 96515->96517 96519 ed0a8c __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 96516->96519 96522 ee2fd7 5 API calls 2 library calls 96517->96522 96520 ed4cf2 96519->96520 96520->96480 96520->96481 96521 ee3648 96521->96516 96522->96521 96523 ebdddc 96526 ebb710 96523->96526 96527 ebb72b 96526->96527 96528 f00146 96527->96528 96529 f000f8 96527->96529 96537 ebb750 96527->96537 96568 f358a2 349 API calls 2 library calls 96528->96568 96532 f00102 96529->96532 96535 f0010f 96529->96535 96529->96537 96566 f35d33 349 API calls 96532->96566 96549 ebba20 96535->96549 96567 f361d0 349 API calls 2 library calls 96535->96567 96539 ebbbe0 40 API calls 96537->96539 96543 ecd336 40 API calls 96537->96543 96544 ebba4e 96537->96544 96546 f00322 96537->96546 96537->96549 96552 ebaceb 23 API calls 96537->96552 96554 ebec40 349 API calls 96537->96554 96557 eba81b 41 API calls 96537->96557 96558 ecd2f0 40 API calls 96537->96558 96559 eca01b 349 API calls 96537->96559 96560 ed0242 5 API calls __Init_thread_wait 96537->96560 96561 ecedcd 22 API calls 96537->96561 96562 ed00a3 29 API calls __onexit 96537->96562 96563 ed01f8 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 96537->96563 96564 ecee53 82 API calls 96537->96564 96565 ece5ca 349 API calls 96537->96565 96569 f0f6bf 23 API calls 96537->96569 96570 eba8c7 22 API calls __fread_nolock 96537->96570 96539->96537 96540 f003d9 96540->96540 96543->96537 96571 f35c0c 82 API calls 96546->96571 96549->96544 96572 f2359c 82 API calls __wsopen_s 96549->96572 96552->96537 96554->96537 96557->96537 96558->96537 96559->96537 96560->96537 96561->96537 96562->96537 96563->96537 96564->96537 96565->96537 96566->96535 96567->96549 96568->96537 96569->96537 96570->96537 96571->96549 96572->96540 96573 eb1033 96578 eb4c91 96573->96578 96577 eb1042 96579 eba961 22 API calls 96578->96579 96580 eb4cff 96579->96580 96586 eb3af0 96580->96586 96582 eb4d9c 96584 eb1038 96582->96584 96589 eb51f7 22 API calls __fread_nolock 96582->96589 96585 ed00a3 29 API calls __onexit 96584->96585 96585->96577 96590 eb3b1c 96586->96590 96589->96582 96591 eb3b0f 96590->96591 96592 eb3b29 96590->96592 96591->96582 96592->96591 96593 eb3b30 RegOpenKeyExW 96592->96593 96593->96591 96594 eb3b4a RegQueryValueExW 96593->96594 96595 eb3b80 RegCloseKey 96594->96595 96596 eb3b6b 96594->96596 96595->96591 96596->96595 96597 eb2e37 96598 eba961 22 API calls 96597->96598 96599 eb2e4d 96598->96599 96676 eb4ae3 96599->96676 96601 eb2e6b 96602 eb3a5a 24 API calls 96601->96602 96603 eb2e7f 96602->96603 96604 eb9cb3 22 API calls 96603->96604 96605 eb2e8c 96604->96605 96606 eb4ecb 94 API calls 96605->96606 96607 eb2ea5 96606->96607 96608 eb2ead 96607->96608 96609 ef2cb0 96607->96609 96690 eba8c7 22 API calls __fread_nolock 96608->96690 96610 f22cf9 80 API calls 96609->96610 96611 ef2cc3 96610->96611 96612 ef2ccf 96611->96612 96614 eb4f39 68 API calls 96611->96614 96617 eb4f39 68 API calls 96612->96617 96614->96612 96615 eb2ec3 96691 eb6f88 22 API calls 96615->96691 96619 ef2ce5 96617->96619 96618 eb2ecf 96620 eb9cb3 22 API calls 96618->96620 96707 eb3084 22 API calls 96619->96707 96621 eb2edc 96620->96621 96692 eba81b 41 API calls 96621->96692 96623 eb2eec 96626 eb9cb3 22 API calls 96623->96626 96625 ef2d02 96708 eb3084 22 API calls 96625->96708 96628 eb2f12 96626->96628 96693 eba81b 41 API calls 96628->96693 96629 ef2d1e 96631 eb3a5a 24 API calls 96629->96631 96632 ef2d44 96631->96632 96709 eb3084 22 API calls 96632->96709 96633 eb2f21 96636 eba961 22 API calls 96633->96636 96635 ef2d50 96710 eba8c7 22 API calls __fread_nolock 96635->96710 96638 eb2f3f 96636->96638 96694 eb3084 22 API calls 96638->96694 96639 ef2d5e 96711 eb3084 22 API calls 96639->96711 96642 eb2f4b 96695 ed4a28 40 API calls 3 library calls 96642->96695 96644 ef2d6d 96712 eba8c7 22 API calls __fread_nolock 96644->96712 96645 eb2f59 96645->96619 96646 eb2f63 96645->96646 96696 ed4a28 40 API calls 3 library calls 96646->96696 96649 eb2f6e 96649->96625 96652 eb2f78 96649->96652 96650 ef2d83 96713 eb3084 22 API calls 96650->96713 96697 ed4a28 40 API calls 3 library calls 96652->96697 96653 ef2d90 96655 eb2f83 96655->96629 96656 eb2f8d 96655->96656 96698 ed4a28 40 API calls 3 library calls 96656->96698 96658 eb2f98 96659 eb2fdc 96658->96659 96699 eb3084 22 API calls 96658->96699 96659->96644 96660 eb2fe8 96659->96660 96660->96653 96662 eb63eb 22 API calls 96660->96662 96665 eb2ff8 96662->96665 96663 eb2fbf 96700 eba8c7 22 API calls __fread_nolock 96663->96700 96702 eb6a50 22 API calls 96665->96702 96666 eb2fcd 96701 eb3084 22 API calls 96666->96701 96669 eb3006 96703 eb70b0 23 API calls 96669->96703 96673 eb3021 96674 eb3065 96673->96674 96704 eb6f88 22 API calls 96673->96704 96705 eb70b0 23 API calls 96673->96705 96706 eb3084 22 API calls 96673->96706 96677 eb4af0 __wsopen_s 96676->96677 96678 eb6b57 22 API calls 96677->96678 96679 eb4b22 96677->96679 96678->96679 96680 eb4c6d 22 API calls 96679->96680 96689 eb4b58 96679->96689 96680->96679 96681 eb4c6d 22 API calls 96681->96689 96682 eb9cb3 22 API calls 96683 eb4c52 96682->96683 96685 eb515f 22 API calls 96683->96685 96684 eb9cb3 22 API calls 96684->96689 96687 eb4c5e 96685->96687 96686 eb515f 22 API calls 96686->96689 96687->96601 96688 eb4c29 96688->96682 96688->96687 96689->96681 96689->96684 96689->96686 96689->96688 96690->96615 96691->96618 96692->96623 96693->96633 96694->96642 96695->96645 96696->96649 96697->96655 96698->96658 96699->96663 96700->96666 96701->96659 96702->96669 96703->96673 96704->96673 96705->96673 96706->96673 96707->96625 96708->96629 96709->96635 96710->96639 96711->96644 96712->96650 96713->96653 96714 eb3156 96717 eb3170 96714->96717 96718 eb3187 96717->96718 96719 eb31eb 96718->96719 96720 eb318c 96718->96720 96755 eb31e9 96718->96755 96724 ef2dfb 96719->96724 96725 eb31f1 96719->96725 96721 eb3199 96720->96721 96722 eb3265 PostQuitMessage 96720->96722 96727 ef2e7c 96721->96727 96728 eb31a4 96721->96728 96759 eb316a 96722->96759 96723 eb31d0 DefWindowProcW 96723->96759 96772 eb18e2 10 API calls 96724->96772 96729 eb31f8 96725->96729 96730 eb321d SetTimer RegisterWindowMessageW 96725->96730 96775 f1bf30 34 API calls ___scrt_fastfail 96727->96775 96732 eb31ae 96728->96732 96733 ef2e68 96728->96733 96736 ef2d9c 96729->96736 96737 eb3201 KillTimer 96729->96737 96734 eb3246 CreatePopupMenu 96730->96734 96730->96759 96731 ef2e1c 96773 ece499 42 API calls 96731->96773 96741 ef2e4d 96732->96741 96742 eb31b9 96732->96742 96762 f1c161 96733->96762 96734->96759 96744 ef2dd7 MoveWindow 96736->96744 96745 ef2da1 96736->96745 96738 eb30f2 Shell_NotifyIconW 96737->96738 96746 eb3214 96738->96746 96741->96723 96774 f10ad7 22 API calls 96741->96774 96747 eb3253 96742->96747 96753 eb31c4 96742->96753 96743 ef2e8e 96743->96723 96743->96759 96744->96759 96748 ef2da7 96745->96748 96749 ef2dc6 SetFocus 96745->96749 96769 eb3c50 DeleteObject DestroyWindow 96746->96769 96770 eb326f 44 API calls ___scrt_fastfail 96747->96770 96748->96753 96754 ef2db0 96748->96754 96749->96759 96753->96723 96758 eb30f2 Shell_NotifyIconW 96753->96758 96771 eb18e2 10 API calls 96754->96771 96755->96723 96756 eb3263 96756->96759 96760 ef2e41 96758->96760 96761 eb3837 49 API calls 96760->96761 96761->96755 96763 f1c276 96762->96763 96764 f1c179 ___scrt_fastfail 96762->96764 96763->96759 96765 eb3923 24 API calls 96764->96765 96767 f1c1a0 96765->96767 96766 f1c25f KillTimer SetTimer 96766->96763 96767->96766 96768 f1c251 Shell_NotifyIconW 96767->96768 96768->96766 96769->96759 96770->96756 96771->96759 96772->96731 96773->96753 96774->96755 96775->96743

                                                        Executed Functions

                                                        Function 00EB42DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235libraryloaderCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 390 eb42de-eb434d call eba961 GetVersionExW call eb6b57 395 ef3617-ef362a 390->395 396 eb4353 390->396 398 ef362b-ef362f 395->398 397 eb4355-eb4357 396->397 399 eb435d-eb43bc call eb93b2 call eb37a0 397->399 400 ef3656 397->400 401 ef3632-ef363e 398->401 402 ef3631 398->402 419 ef37df-ef37e6 399->419 420 eb43c2-eb43c4 399->420 405 ef365d-ef3660 400->405 401->398 404 ef3640-ef3642 401->404 402->401 404->397 407 ef3648-ef364f 404->407 408 eb441b-eb4435 GetCurrentProcess IsWow64Process 405->408 409 ef3666-ef36a8 405->409 407->395 411 ef3651 407->411 414 eb4437 408->414 415 eb4494-eb449a 408->415 409->408 412 ef36ae-ef36b1 409->412 411->400 417 ef36db-ef36e5 412->417 418 ef36b3-ef36bd 412->418 416 eb443d-eb4449 414->416 415->416 421 eb444f-eb445e LoadLibraryA 416->421 422 ef3824-ef3828 GetSystemInfo 416->422 426 ef36f8-ef3702 417->426 427 ef36e7-ef36f3 417->427 423 ef36bf-ef36c5 418->423 424 ef36ca-ef36d6 418->424 428 ef37e8 419->428 429 ef3806-ef3809 419->429 420->405 425 eb43ca-eb43dd 420->425 430 eb449c-eb44a6 GetSystemInfo 421->430 431 eb4460-eb446e GetProcAddress 421->431 423->408 424->408 432 eb43e3-eb43e5 425->432 433 ef3726-ef372f 425->433 435 ef3715-ef3721 426->435 436 ef3704-ef3710 426->436 427->408 434 ef37ee 428->434 437 ef380b-ef381a 429->437 438 ef37f4-ef37fc 429->438 441 eb4476-eb4478 430->441 431->430 440 eb4470-eb4474 GetNativeSystemInfo 431->440 442 eb43eb-eb43ee 432->442 443 ef374d-ef3762 432->443 444 ef373c-ef3748 433->444 445 ef3731-ef3737 433->445 434->438 435->408 436->408 437->434 439 ef381c-ef3822 437->439 438->429 439->438 440->441 448 eb447a-eb447b FreeLibrary 441->448 449 eb4481-eb4493 441->449 450 ef3791-ef3794 442->450 451 eb43f4-eb440f 442->451 446 ef376f-ef377b 443->446 447 ef3764-ef376a 443->447 444->408 445->408 446->408 447->408 448->449 450->408 452 ef379a-ef37c1 450->452 453 eb4415 451->453 454 ef3780-ef378c 451->454 455 ef37ce-ef37da 452->455 456 ef37c3-ef37c9 452->456 453->408 454->408 455->408 456->408
                                                        APIs
                                                        • GetVersionExW.KERNEL32(?), ref: 00EB430D
                                                          • Part of subcall function 00EB6B57: _wcslen.LIBCMT ref: 00EB6B6A
                                                        • GetCurrentProcess.KERNEL32(?,00F4CB64,00000000,?,?), ref: 00EB4422
                                                        • IsWow64Process.KERNEL32(00000000,?,?), ref: 00EB4429
                                                        • LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 00EB4454
                                                        • GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00EB4466
                                                        • GetNativeSystemInfo.KERNELBASE(?,?,?), ref: 00EB4474
                                                        • FreeLibrary.KERNEL32(00000000,?,?), ref: 00EB447B
                                                        • GetSystemInfo.KERNEL32(?,?,?), ref: 00EB44A0
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
                                                        • String ID: GetNativeSystemInfo$kernel32.dll$|O
                                                        • API String ID: 3290436268-3101561225
                                                        • Opcode ID: 634d9e2fb9a655a6c9fae9f748d9eb5fc22cc0e77a62d4d291aa9d9ab229ce17
                                                        • Instruction ID: 689bf5a2e02b77920906a5ace3cc22245b76037777ef65e254349ffb6dbd2f79
                                                        • Opcode Fuzzy Hash: 634d9e2fb9a655a6c9fae9f748d9eb5fc22cc0e77a62d4d291aa9d9ab229ce17
                                                        • Instruction Fuzzy Hash: D7A1B6B590A2CCDFC722D7B97C411F67FEC7B36704B086AA9D481A3A62D2604506FB61
                                                        Function 00EB42A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 794 eb42a2-eb42ba CreateStreamOnHGlobal 795 eb42da-eb42dd 794->795 796 eb42bc-eb42d3 FindResourceExW 794->796 797 eb42d9 796->797 798 ef35ba-ef35c9 LoadResource 796->798 797->795 798->797 799 ef35cf-ef35dd SizeofResource 798->799 799->797 800 ef35e3-ef35ee LockResource 799->800 800->797 801 ef35f4-ef3612 800->801 801->797
                                                        APIs
                                                        • CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,00EB50AA,?,?,00000000,00000000), ref: 00EB42B2
                                                        • FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00EB50AA,?,?,00000000,00000000), ref: 00EB42C9
                                                        • LoadResource.KERNEL32(?,00000000,?,?,00EB50AA,?,?,00000000,00000000,?,?,?,?,?,?,00EB4F20), ref: 00EF35BE
                                                        • SizeofResource.KERNEL32(?,00000000,?,?,00EB50AA,?,?,00000000,00000000,?,?,?,?,?,?,00EB4F20), ref: 00EF35D3
                                                        • LockResource.KERNEL32(00EB50AA,?,?,00EB50AA,?,?,00000000,00000000,?,?,?,?,?,?,00EB4F20,?), ref: 00EF35E6
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Resource$CreateFindGlobalLoadLockSizeofStream
                                                        • String ID: SCRIPT
                                                        • API String ID: 3051347437-3967369404
                                                        • Opcode ID: 3558b38ba0e38668b9f97ae596dc1ade0bcb48bb581d7f4bfdc2f187ef6b95f9
                                                        • Instruction ID: 4140d2c7af929dd023135617062be0c9699a12a50728f813bc76900733069425
                                                        • Opcode Fuzzy Hash: 3558b38ba0e38668b9f97ae596dc1ade0bcb48bb581d7f4bfdc2f187ef6b95f9
                                                        • Instruction Fuzzy Hash: 9911CEB4201704BFE7219FA5DC49F677BB9EBC6B51F104169F802E62A0DBB1DC00A660
                                                        Function 00F1DBBE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 29filestringCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 919 f1dbbe-f1dbda lstrlenW 920 f1dc06 919->920 921 f1dbdc-f1dbe6 GetFileAttributesW 919->921 922 f1dc09-f1dc0d 920->922 921->922 923 f1dbe8-f1dbf7 FindFirstFileW 921->923 923->920 924 f1dbf9-f1dc04 FindClose 923->924 924->922
                                                        APIs
                                                        • lstrlenW.KERNEL32(?,"R), ref: 00F1DBCE
                                                        • GetFileAttributesW.KERNELBASE(?), ref: 00F1DBDD
                                                        • FindFirstFileW.KERNEL32(?,?), ref: 00F1DBEE
                                                        • FindClose.KERNEL32(00000000), ref: 00F1DBFA
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: FileFind$AttributesCloseFirstlstrlen
                                                        • String ID: "R
                                                        • API String ID: 2695905019-1746183819
                                                        • Opcode ID: 72adc52f4b305e968ff592eecb68b3e1f361d6df44fa514e562b4cb7263aa879
                                                        • Instruction ID: 21e71461e2d2a0f44cb356eca37071c6d34f14828e529a6f45db59b5b3afd06e
                                                        • Opcode Fuzzy Hash: 72adc52f4b305e968ff592eecb68b3e1f361d6df44fa514e562b4cb7263aa879
                                                        • Instruction Fuzzy Hash: 3BF0E53981191857C2206B7CAC0D8EA377C9E42334B105B02FD36C20F0EBF15E94E6D5
                                                        Function 00EF2BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        APIs
                                                        • SetCurrentDirectoryW.KERNEL32(?), ref: 00EB2B6B
                                                          • Part of subcall function 00EB3A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00F81418,?,00EB2E7F,?,?,?,00000000), ref: 00EB3A78
                                                          • Part of subcall function 00EB9CB3: _wcslen.LIBCMT ref: 00EB9CBD
                                                        • GetForegroundWindow.USER32(runas,?,?,?,?,?,00F72224), ref: 00EF2C10
                                                        • ShellExecuteW.SHELL32(00000000,?,?,00F72224), ref: 00EF2C17
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: CurrentDirectoryExecuteFileForegroundModuleNameShellWindow_wcslen
                                                        • String ID: runas
                                                        • API String ID: 448630720-4000483414
                                                        • Opcode ID: a4eb8343b6d47d7a905e27d49f926cb321b7424eb341a25356e0de02f6080e02
                                                        • Instruction ID: b4ada2b7892d31cc81edcd7779f7a9f35e0e3ab731c5afc6abf1c87ed8ec8d54
                                                        • Opcode Fuzzy Hash: a4eb8343b6d47d7a905e27d49f926cb321b7424eb341a25356e0de02f6080e02
                                                        • Instruction Fuzzy Hash: 62118E312083056AC705FF70D8929FFBBE8AF91700F44352DB686620A3DF20854AA752
                                                        Function 00ED4CE8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20COMMONLIBRARYCODE
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 972 ed4ce8-ed4cf4 call ee360c 975 ed4d16-ed4d22 call ed4d6d ExitProcess 972->975 976 ed4cf6-ed4d04 GetPEB 972->976 976->975 977 ed4d06-ed4d10 GetCurrentProcess TerminateProcess 976->977 977->975
                                                        APIs
                                                        • GetCurrentProcess.KERNEL32(00EE28E9,(,00ED4CBE,00000000,00F788B8,0000000C,00ED4E15,(,00000002,00000000,?,00EE28E9,00000003,00EE2DF7,?,?), ref: 00ED4D09
                                                        • TerminateProcess.KERNEL32(00000000,?,00EE28E9,00000003,00EE2DF7,?,?,?,00EDE6D1,?,00F78A48,00000010,00EB4F4A,?,?,00000000), ref: 00ED4D10
                                                        • ExitProcess.KERNEL32 ref: 00ED4D22
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Process$CurrentExitTerminate
                                                        • String ID: (
                                                        • API String ID: 1703294689-2063206799
                                                        • Opcode ID: 1f28e4040ee5d981ef29868c6fe90c3e55105760571915d3988952f00cc3e06d
                                                        • Instruction ID: 98567dea9eb942c7cd2664008e0bfb6c4129b0bccee8244e3de184b51e8add9b
                                                        • Opcode Fuzzy Hash: 1f28e4040ee5d981ef29868c6fe90c3e55105760571915d3988952f00cc3e06d
                                                        • Instruction Fuzzy Hash: F1E0B6B500118CABCF61AF64DD09A583B6AEB62785B146015FC05AB2A2CB35DD42DA80
                                                        Function 00F3A67C Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CreateToolhelp32Snapshot.KERNEL32 ref: 00F3A6AC
                                                        • Process32FirstW.KERNEL32(00000000,?), ref: 00F3A6BA
                                                          • Part of subcall function 00EB9CB3: _wcslen.LIBCMT ref: 00EB9CBD
                                                        • Process32NextW.KERNEL32(00000000,?), ref: 00F3A79C
                                                        • CloseHandle.KERNELBASE(00000000), ref: 00F3A7AB
                                                          • Part of subcall function 00ECCE60: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,00EF3303,?), ref: 00ECCE8A
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
                                                        • String ID:
                                                        • API String ID: 1991900642-0
                                                        • Opcode ID: e34d559652e187f412c6de18bea5752b2371627a16cce710c35b109fd4aa86b1
                                                        • Instruction ID: 4db10e18274411efdc88788c1a881ff91b308b663f2988befcfd4e1dd3b35baa
                                                        • Opcode Fuzzy Hash: e34d559652e187f412c6de18bea5752b2371627a16cce710c35b109fd4aa86b1
                                                        • Instruction Fuzzy Hash: E8515C71508300AFD714EF24C886E6BBBE8FF89754F00592DF985A7292EB35D905CB92
                                                        Function 00F3AFF9 Relevance: 24.4, APIs: 16, Instructions: 418processCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 0 f3aff9-f3b056 call ed2340 3 f3b094-f3b098 0->3 4 f3b058-f3b06b call ebb567 0->4 6 f3b09a-f3b0bb call ebb567 * 2 3->6 7 f3b0dd-f3b0e0 3->7 12 f3b0c8 4->12 13 f3b06d-f3b092 call ebb567 * 2 4->13 28 f3b0bf-f3b0c4 6->28 9 f3b0e2-f3b0e5 7->9 10 f3b0f5-f3b119 call eb7510 call eb7620 7->10 14 f3b0e8-f3b0ed call ebb567 9->14 31 f3b1d8-f3b1e0 10->31 32 f3b11f-f3b178 call eb7510 call eb7620 call eb7510 call eb7620 call eb7510 call eb7620 10->32 17 f3b0cb-f3b0cf 12->17 13->28 14->10 22 f3b0d1-f3b0d7 17->22 23 f3b0d9-f3b0db 17->23 22->14 23->7 23->10 28->7 33 f3b0c6 28->33 36 f3b1e2-f3b1fd call eb7510 call eb7620 31->36 37 f3b20a-f3b238 GetCurrentDirectoryW call ecfe0b GetCurrentDirectoryW 31->37 82 f3b1a6-f3b1d6 GetSystemDirectoryW call ecfe0b GetSystemDirectoryW 32->82 83 f3b17a-f3b195 call eb7510 call eb7620 32->83 33->17 36->37 53 f3b1ff-f3b208 call ed4963 36->53 45 f3b23c 37->45 48 f3b240-f3b244 45->48 51 f3b246-f3b270 call eb9c6e * 3 48->51 52 f3b275-f3b285 call f200d9 48->52 51->52 64 f3b287-f3b289 52->64 65 f3b28b-f3b2e1 call f207c0 call f206e6 call f205a7 52->65 53->37 53->52 66 f3b2ee-f3b2f2 64->66 65->66 98 f3b2e3 65->98 71 f3b39a-f3b3be CreateProcessW 66->71 72 f3b2f8-f3b321 call f111c8 66->72 76 f3b3c1-f3b3d4 call ecfe14 * 2 71->76 87 f3b323-f3b328 call f11201 72->87 88 f3b32a call f114ce 72->88 103 f3b3d6-f3b3e8 76->103 104 f3b42f-f3b43d CloseHandle 76->104 82->45 83->82 105 f3b197-f3b1a0 call ed4963 83->105 97 f3b32f-f3b33c call ed4963 87->97 88->97 113 f3b347-f3b357 call ed4963 97->113 114 f3b33e-f3b345 97->114 98->66 109 f3b3ea 103->109 110 f3b3ed-f3b3fc 103->110 107 f3b43f-f3b444 104->107 108 f3b49c 104->108 105->48 105->82 115 f3b451-f3b456 107->115 116 f3b446-f3b44c CloseHandle 107->116 111 f3b4a0-f3b4a4 108->111 109->110 117 f3b401-f3b42a GetLastError call eb630c call ebcfa0 110->117 118 f3b3fe 110->118 119 f3b4b2-f3b4bc 111->119 120 f3b4a6-f3b4b0 111->120 136 f3b362-f3b372 call ed4963 113->136 137 f3b359-f3b360 113->137 114->113 114->114 123 f3b463-f3b468 115->123 124 f3b458-f3b45e CloseHandle 115->124 116->115 127 f3b4e5-f3b4f6 call f20175 117->127 118->117 128 f3b4c4-f3b4e3 call ebcfa0 CloseHandle 119->128 129 f3b4be 119->129 120->127 131 f3b475-f3b49a call f209d9 call f3b536 123->131 132 f3b46a-f3b470 CloseHandle 123->132 124->123 128->127 129->128 131->111 132->131 146 f3b374-f3b37b 136->146 147 f3b37d-f3b398 call ecfe14 * 3 136->147 137->136 137->137 146->146 146->147 147->76
                                                        APIs
                                                        • _wcslen.LIBCMT ref: 00F3B198
                                                        • GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00F3B1B0
                                                        • GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00F3B1D4
                                                        • _wcslen.LIBCMT ref: 00F3B200
                                                        • GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00F3B214
                                                        • GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00F3B236
                                                        • _wcslen.LIBCMT ref: 00F3B332
                                                          • Part of subcall function 00F205A7: GetStdHandle.KERNEL32(000000F6), ref: 00F205C6
                                                        • _wcslen.LIBCMT ref: 00F3B34B
                                                        • _wcslen.LIBCMT ref: 00F3B366
                                                        • CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00F3B3B6
                                                        • GetLastError.KERNEL32(00000000), ref: 00F3B407
                                                        • CloseHandle.KERNEL32(?), ref: 00F3B439
                                                        • CloseHandle.KERNEL32(00000000), ref: 00F3B44A
                                                        • CloseHandle.KERNEL32(00000000), ref: 00F3B45C
                                                        • CloseHandle.KERNEL32(00000000), ref: 00F3B46E
                                                        • CloseHandle.KERNEL32(?), ref: 00F3B4E3
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
                                                        • String ID:
                                                        • API String ID: 2178637699-0
                                                        • Opcode ID: ffac67580e307ca0af258cc2db07354fc8511e421411fdb2ce019ab2cc87618c
                                                        • Instruction ID: 8598544fc7dcc8434203eae12334522dcb1f8a0eab48bf282f57ab4243a585e9
                                                        • Opcode Fuzzy Hash: ffac67580e307ca0af258cc2db07354fc8511e421411fdb2ce019ab2cc87618c
                                                        • Instruction Fuzzy Hash: 32F1A071A083409FC724EF24C8A1B6FBBE5AF85320F14855DF9959B2A2CB31EC45DB52
                                                        Function 00EBD730 Relevance: 21.6, APIs: 14, Instructions: 624windowsleeptimeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetInputState.USER32 ref: 00EBD807
                                                        • timeGetTime.WINMM ref: 00EBDA07
                                                        • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00EBDB28
                                                        • TranslateMessage.USER32(?), ref: 00EBDB7B
                                                        • DispatchMessageW.USER32(?), ref: 00EBDB89
                                                        • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00EBDB9F
                                                        • Sleep.KERNELBASE(0000000A), ref: 00EBDBB1
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Message$Peek$DispatchInputSleepStateTimeTranslatetime
                                                        • String ID:
                                                        • API String ID: 2189390790-0
                                                        • Opcode ID: 2b98e8892882695e0bd106fb2d6f867593d03e040b62c0a3de1b0d4050bf2d70
                                                        • Instruction ID: ea6ba25b8f8a9bd09933bc074a35d9c4c4262dfc5b85ad1b918bbfd6e736380e
                                                        • Opcode Fuzzy Hash: 2b98e8892882695e0bd106fb2d6f867593d03e040b62c0a3de1b0d4050bf2d70
                                                        • Instruction Fuzzy Hash: 92420370608245DFD729CF24CC88BEBBBE0BF85314F14961DE855A7291E7B4E844EB92
                                                        Function 00EB2CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53windowregistryCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        APIs
                                                        • GetSysColorBrush.USER32(0000000F), ref: 00EB2D07
                                                        • RegisterClassExW.USER32(00000030), ref: 00EB2D31
                                                        • RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00EB2D42
                                                        • InitCommonControlsEx.COMCTL32(?), ref: 00EB2D5F
                                                        • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00EB2D6F
                                                        • LoadIconW.USER32(000000A9), ref: 00EB2D85
                                                        • ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00EB2D94
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
                                                        • String ID: +$0$AutoIt v3 GUI$TaskbarCreated
                                                        • API String ID: 2914291525-1005189915
                                                        • Opcode ID: 141f807468c2da49a4ccb27eb15eef85e3085aa534f617c0b533b75e31141770
                                                        • Instruction ID: 215f5f8c72329d1be9c5a13811d15df2210fc13253beb6a9aa922502f0a1751a
                                                        • Opcode Fuzzy Hash: 141f807468c2da49a4ccb27eb15eef85e3085aa534f617c0b533b75e31141770
                                                        • Instruction Fuzzy Hash: EC21C4B591231CAFDB40DFA4EC49BEDBBB8FB09700F00521AF911A62A0D7B54545EF91
                                                        Function 00EF065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272COMMONLIBRARYCODE
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 458 ef065b-ef068b call ef042f 461 ef068d-ef0698 call edf2c6 458->461 462 ef06a6-ef06b2 call ee5221 458->462 467 ef069a-ef06a1 call edf2d9 461->467 468 ef06cb-ef0714 call ef039a 462->468 469 ef06b4-ef06c9 call edf2c6 call edf2d9 462->469 478 ef097d-ef0983 467->478 476 ef0716-ef071f 468->476 477 ef0781-ef078a GetFileType 468->477 469->467 480 ef0756-ef077c GetLastError call edf2a3 476->480 481 ef0721-ef0725 476->481 482 ef078c-ef07bd GetLastError call edf2a3 CloseHandle 477->482 483 ef07d3-ef07d6 477->483 480->467 481->480 487 ef0727-ef0754 call ef039a 481->487 482->467 497 ef07c3-ef07ce call edf2d9 482->497 485 ef07df-ef07e5 483->485 486 ef07d8-ef07dd 483->486 490 ef07e9-ef0837 call ee516a 485->490 491 ef07e7 485->491 486->490 487->477 487->480 501 ef0839-ef0845 call ef05ab 490->501 502 ef0847-ef086b call ef014d 490->502 491->490 497->467 501->502 507 ef086f-ef0879 call ee86ae 501->507 508 ef087e-ef08c1 502->508 509 ef086d 502->509 507->478 511 ef08c3-ef08c7 508->511 512 ef08e2-ef08f0 508->512 509->507 511->512 514 ef08c9-ef08dd 511->514 515 ef097b 512->515 516 ef08f6-ef08fa 512->516 514->512 515->478 516->515 517 ef08fc-ef092f CloseHandle call ef039a 516->517 520 ef0963-ef0977 517->520 521 ef0931-ef095d GetLastError call edf2a3 call ee5333 517->521 520->515 521->520
                                                        APIs
                                                          • Part of subcall function 00EF039A: CreateFileW.KERNELBASE(00000000,00000000,?,00EF0704,?,?,00000000,?,00EF0704,00000000,0000000C), ref: 00EF03B7
                                                        • GetLastError.KERNEL32 ref: 00EF076F
                                                        • __dosmaperr.LIBCMT ref: 00EF0776
                                                        • GetFileType.KERNELBASE(00000000), ref: 00EF0782
                                                        • GetLastError.KERNEL32 ref: 00EF078C
                                                        • __dosmaperr.LIBCMT ref: 00EF0795
                                                        • CloseHandle.KERNEL32(00000000), ref: 00EF07B5
                                                        • CloseHandle.KERNEL32(?), ref: 00EF08FF
                                                        • GetLastError.KERNEL32 ref: 00EF0931
                                                        • __dosmaperr.LIBCMT ref: 00EF0938
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
                                                        • String ID: H
                                                        • API String ID: 4237864984-2852464175
                                                        • Opcode ID: 0fd3f4160be89a7b6c98cdf89f8e61a1f98d9af762d7dd07d7c2554c6a91c6d9
                                                        • Instruction ID: 1b0720d535d361b44af03c69cd90fd0324c541a50fc79c707a0d21c5e4f589d4
                                                        • Opcode Fuzzy Hash: 0fd3f4160be89a7b6c98cdf89f8e61a1f98d9af762d7dd07d7c2554c6a91c6d9
                                                        • Instruction Fuzzy Hash: 88A13332A0010C8FDF19EF68D851BBE7BE0EB46324F14515AF915AB3E2DA318912DB91
                                                        Function 00EB344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201registryCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        APIs
                                                          • Part of subcall function 00EB3A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00F81418,?,00EB2E7F,?,?,?,00000000), ref: 00EB3A78
                                                          • Part of subcall function 00EB3357: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00EB3379
                                                        • RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 00EB356A
                                                        • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00EF318D
                                                        • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00EF31CE
                                                        • RegCloseKey.ADVAPI32(?), ref: 00EF3210
                                                        • _wcslen.LIBCMT ref: 00EF3277
                                                        • _wcslen.LIBCMT ref: 00EF3286
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
                                                        • String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
                                                        • API String ID: 98802146-2727554177
                                                        • Opcode ID: 2dada09d7b3a781d4089910428dd53c0a7773848475a02868a15e243e9017236
                                                        • Instruction ID: d8cdf7e6f544871c2a1bcab5f89ada807861a2de253cb2be4b61395046957946
                                                        • Opcode Fuzzy Hash: 2dada09d7b3a781d4089910428dd53c0a7773848475a02868a15e243e9017236
                                                        • Instruction Fuzzy Hash: 7271C1714053089EC354EF69EC929EBBBE8FF85740F40242EF545A31B1EB34AA48DB52
                                                        Function 00EB2B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63windowregistryCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        APIs
                                                        • GetSysColorBrush.USER32(0000000F), ref: 00EB2B8E
                                                        • LoadCursorW.USER32(00000000,00007F00), ref: 00EB2B9D
                                                        • LoadIconW.USER32(00000063), ref: 00EB2BB3
                                                        • LoadIconW.USER32(000000A4), ref: 00EB2BC5
                                                        • LoadIconW.USER32(000000A2), ref: 00EB2BD7
                                                        • LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00EB2BEF
                                                        • RegisterClassExW.USER32(?), ref: 00EB2C40
                                                          • Part of subcall function 00EB2CD4: GetSysColorBrush.USER32(0000000F), ref: 00EB2D07
                                                          • Part of subcall function 00EB2CD4: RegisterClassExW.USER32(00000030), ref: 00EB2D31
                                                          • Part of subcall function 00EB2CD4: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00EB2D42
                                                          • Part of subcall function 00EB2CD4: InitCommonControlsEx.COMCTL32(?), ref: 00EB2D5F
                                                          • Part of subcall function 00EB2CD4: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00EB2D6F
                                                          • Part of subcall function 00EB2CD4: LoadIconW.USER32(000000A9), ref: 00EB2D85
                                                          • Part of subcall function 00EB2CD4: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00EB2D94
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
                                                        • String ID: #$0$AutoIt v3
                                                        • API String ID: 423443420-4155596026
                                                        • Opcode ID: 20b1e53f7455c173b7cbd27635ca45c58892eb18f87f233954ecd84508ba9b12
                                                        • Instruction ID: f93a0e91f95151d641a8967962cf6398220d35847ffa353ea296a0a4ecef529d
                                                        • Opcode Fuzzy Hash: 20b1e53f7455c173b7cbd27635ca45c58892eb18f87f233954ecd84508ba9b12
                                                        • Instruction Fuzzy Hash: 10212974E0131CABDB109FA5EC55AEE7FB8FB48B50F04021AEA00A66A0D7B10541EF90
                                                        Function 00EB3170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145windowtimeregistryCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 599 eb3170-eb3185 600 eb3187-eb318a 599->600 601 eb31e5-eb31e7 599->601 602 eb31eb 600->602 603 eb318c-eb3193 600->603 601->600 604 eb31e9 601->604 608 ef2dfb-ef2e23 call eb18e2 call ece499 602->608 609 eb31f1-eb31f6 602->609 605 eb3199-eb319e 603->605 606 eb3265-eb326d PostQuitMessage 603->606 607 eb31d0-eb31d8 DefWindowProcW 604->607 611 ef2e7c-ef2e90 call f1bf30 605->611 612 eb31a4-eb31a8 605->612 614 eb3219-eb321b 606->614 613 eb31de-eb31e4 607->613 644 ef2e28-ef2e2f 608->644 615 eb31f8-eb31fb 609->615 616 eb321d-eb3244 SetTimer RegisterWindowMessageW 609->616 611->614 637 ef2e96 611->637 618 eb31ae-eb31b3 612->618 619 ef2e68-ef2e72 call f1c161 612->619 614->613 622 ef2d9c-ef2d9f 615->622 623 eb3201-eb320f KillTimer call eb30f2 615->623 616->614 620 eb3246-eb3251 CreatePopupMenu 616->620 627 ef2e4d-ef2e54 618->627 628 eb31b9-eb31be 618->628 633 ef2e77 619->633 620->614 630 ef2dd7-ef2df6 MoveWindow 622->630 631 ef2da1-ef2da5 622->631 632 eb3214 call eb3c50 623->632 627->607 640 ef2e5a-ef2e63 call f10ad7 627->640 635 eb3253-eb3263 call eb326f 628->635 636 eb31c4-eb31ca 628->636 630->614 638 ef2da7-ef2daa 631->638 639 ef2dc6-ef2dd2 SetFocus 631->639 632->614 633->614 635->614 636->607 636->644 637->607 638->636 645 ef2db0-ef2dc1 call eb18e2 638->645 639->614 640->607 644->607 648 ef2e35-ef2e48 call eb30f2 call eb3837 644->648 645->614 648->607
                                                        APIs
                                                        • DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,00EB316A,?,?), ref: 00EB31D8
                                                        • KillTimer.USER32(?,00000001,?,?,?,?,?,00EB316A,?,?), ref: 00EB3204
                                                        • SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00EB3227
                                                        • RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,00EB316A,?,?), ref: 00EB3232
                                                        • CreatePopupMenu.USER32 ref: 00EB3246
                                                        • PostQuitMessage.USER32(00000000), ref: 00EB3267
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
                                                        • String ID: TaskbarCreated
                                                        • API String ID: 129472671-2362178303
                                                        • Opcode ID: 896bd1ecacf9c4f9d1c13f5f02974bee687d736c6c686ae27449c62a6f4a69ea
                                                        • Instruction ID: a75f8faa518f12c0df4480a7cb920c176ae529a78108554e8672914d45ef3b5c
                                                        • Opcode Fuzzy Hash: 896bd1ecacf9c4f9d1c13f5f02974bee687d736c6c686ae27449c62a6f4a69ea
                                                        • Instruction Fuzzy Hash: AE41273524120CA7DB152B78DC0FBFB3A5DFB06304F043229FA41B62A2CB718A41B7A1
                                                        Function 00EB1410 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 655 eb1410-eb1449 656 eb144f-eb1465 mciSendStringW 655->656 657 ef24b8-ef24b9 DestroyWindow 655->657 658 eb146b-eb1473 656->658 659 eb16c6-eb16d3 656->659 660 ef24c4-ef24d1 657->660 658->660 661 eb1479-eb1488 call eb182e 658->661 662 eb16f8-eb16ff 659->662 663 eb16d5-eb16f0 UnregisterHotKey 659->663 664 ef24d3-ef24d6 660->664 665 ef2500-ef2507 660->665 676 ef250e-ef251a 661->676 677 eb148e-eb1496 661->677 662->658 668 eb1705 662->668 663->662 667 eb16f2-eb16f3 call eb10d0 663->667 669 ef24d8-ef24e0 call eb6246 664->669 670 ef24e2-ef24e5 FindClose 664->670 665->660 673 ef2509 665->673 667->662 668->659 675 ef24eb-ef24f8 669->675 670->675 673->676 675->665 681 ef24fa-ef24fb call f232b1 675->681 678 ef251c-ef251e FreeLibrary 676->678 679 ef2524-ef252b 676->679 682 eb149c-eb14c1 call ebcfa0 677->682 683 ef2532-ef253f 677->683 678->679 679->676 684 ef252d 679->684 681->665 693 eb14f8-eb1503 CoUninitialize 682->693 694 eb14c3 682->694 685 ef2566-ef256d 683->685 686 ef2541-ef255e VirtualFree 683->686 684->683 685->683 690 ef256f 685->690 686->685 689 ef2560-ef2561 call f23317 686->689 689->685 696 ef2574-ef2578 690->696 695 eb1509-eb150e 693->695 693->696 697 eb14c6-eb14f6 call eb1a05 call eb19ae 694->697 698 ef2589-ef2596 call f232eb 695->698 699 eb1514-eb151e 695->699 696->695 700 ef257e-ef2584 696->700 697->693 711 ef2598 698->711 704 eb1707-eb1714 call ecf80e 699->704 705 eb1524-eb15a5 call eb988f call eb1944 call eb17d5 call ecfe14 call eb177c call eb988f call ebcfa0 call eb17fe call ecfe14 699->705 700->695 704->705 715 eb171a 704->715 717 ef259d-ef25bf call ecfdcd 705->717 745 eb15ab-eb15cf call ecfe14 705->745 711->717 715->704 723 ef25c1 717->723 726 ef25c6-ef25e8 call ecfdcd 723->726 733 ef25ea 726->733 736 ef25ef-ef2611 call ecfdcd 733->736 741 ef2613 736->741 744 ef2618-ef2625 call f164d4 741->744 750 ef2627 744->750 745->726 751 eb15d5-eb15f9 call ecfe14 745->751 753 ef262c-ef2639 call ecac64 750->753 751->736 756 eb15ff-eb1619 call ecfe14 751->756 760 ef263b 753->760 756->744 761 eb161f-eb1643 call eb17d5 call ecfe14 756->761 763 ef2640-ef264d call f23245 760->763 761->753 770 eb1649-eb1651 761->770 768 ef264f 763->768 771 ef2654-ef2661 call f232cc 768->771 770->763 772 eb1657-eb1675 call eb988f call eb190a 770->772 777 ef2663 771->777 772->771 781 eb167b-eb1689 772->781 780 ef2668-ef2675 call f232cc 777->780 787 ef2677 780->787 781->780 783 eb168f-eb16c5 call eb988f * 3 call eb1876 781->783 787->787
                                                        APIs
                                                        • mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00EB1459
                                                        • CoUninitialize.COMBASE ref: 00EB14F8
                                                        • UnregisterHotKey.USER32(?), ref: 00EB16DD
                                                        • DestroyWindow.USER32(?), ref: 00EF24B9
                                                        • FreeLibrary.KERNEL32(?), ref: 00EF251E
                                                        • VirtualFree.KERNEL32(?,00000000,00008000), ref: 00EF254B
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
                                                        • String ID: close all
                                                        • API String ID: 469580280-3243417748
                                                        • Opcode ID: 2527128ddf870587aadae7ee66fa091ea397dc770ff54137d0b525eeff8e4031
                                                        • Instruction ID: 8214ff66873025b99e022240441404dee6ba16e97eadce01dd9e449479beae43
                                                        • Opcode Fuzzy Hash: 2527128ddf870587aadae7ee66fa091ea397dc770ff54137d0b525eeff8e4031
                                                        • Instruction Fuzzy Hash: 12D18F31702212CFCB19DF14C4A5BAAF7A0BF05714F5561ADEA4A7B252CB31AD12CF91
                                                        Function 00EB2C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 804 eb2c63-eb2cd3 CreateWindowExW * 2 ShowWindow * 2
                                                        APIs
                                                        • CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00EB2C91
                                                        • CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00EB2CB2
                                                        • ShowWindow.USER32(00000000,?,?,?,?,?,?,00EB1CAD,?), ref: 00EB2CC6
                                                        • ShowWindow.USER32(00000000,?,?,?,?,?,?,00EB1CAD,?), ref: 00EB2CCF
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Window$CreateShow
                                                        • String ID: AutoIt v3$edit
                                                        • API String ID: 1584632944-3779509399
                                                        • Opcode ID: 3d117b5dca2aa460c24996979a4f2ae5606b5856624b62471c6000c4a53fcdcf
                                                        • Instruction ID: d0d5960dba6579fa8c16f50c085354401a2ddeb5ccd423d35bfc49618f8d2ca0
                                                        • Opcode Fuzzy Hash: 3d117b5dca2aa460c24996979a4f2ae5606b5856624b62471c6000c4a53fcdcf
                                                        • Instruction Fuzzy Hash: 8DF0DA756413987AEB711717AC08EB73EBDE7C7F50B00115AF900A35A0C6761852FBB0
                                                        Function 00EB3B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58registryCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 961 eb3b1c-eb3b27 962 eb3b99-eb3b9b 961->962 963 eb3b29-eb3b2e 961->963 964 eb3b8c-eb3b8f 962->964 963->962 965 eb3b30-eb3b48 RegOpenKeyExW 963->965 965->962 966 eb3b4a-eb3b69 RegQueryValueExW 965->966 967 eb3b6b-eb3b76 966->967 968 eb3b80-eb3b8b RegCloseKey 966->968 969 eb3b78-eb3b7a 967->969 970 eb3b90-eb3b97 967->970 968->964 971 eb3b7e 969->971 970->971 971->968
                                                        APIs
                                                        • RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,00EB3B0F,SwapMouseButtons,00000004,?), ref: 00EB3B40
                                                        • RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,00EB3B0F,SwapMouseButtons,00000004,?), ref: 00EB3B61
                                                        • RegCloseKey.KERNELBASE(00000000,?,?,?,80000001,80000001,?,00EB3B0F,SwapMouseButtons,00000004,?), ref: 00EB3B83
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: CloseOpenQueryValue
                                                        • String ID: Control Panel\Mouse
                                                        • API String ID: 3677997916-824357125
                                                        • Opcode ID: e023fb4b96248455d1607a36542fffe705e7baa1d149778f65dd84d1b8f549ea
                                                        • Instruction ID: 83660b4d20b37f74a03c96d70ca2a04d5f56cc725077ec96350d9ad9e2cb2e07
                                                        • Opcode Fuzzy Hash: e023fb4b96248455d1607a36542fffe705e7baa1d149778f65dd84d1b8f549ea
                                                        • Instruction Fuzzy Hash: 3E115AB5511208FFDB218FA8DC85AEFBBB8EF01744B105559A801E7114D6319E40A7A0
                                                        Function 00EB3923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00EF33A2
                                                          • Part of subcall function 00EB6B57: _wcslen.LIBCMT ref: 00EB6B6A
                                                        • Shell_NotifyIconW.SHELL32(00000001,?), ref: 00EB3A04
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: IconLoadNotifyShell_String_wcslen
                                                        • String ID: Line:
                                                        • API String ID: 2289894680-1585850449
                                                        • Opcode ID: adb12eda72c8c4a9ee92b1e728b5c049c95f156a7735f6fff9c186ffe06f792c
                                                        • Instruction ID: 6045f32074c47cbb97bc58cb0fa4205d8f4ab782521896150188a6c8d2be4aa0
                                                        • Opcode Fuzzy Hash: adb12eda72c8c4a9ee92b1e728b5c049c95f156a7735f6fff9c186ffe06f792c
                                                        • Instruction Fuzzy Hash: 2F31F671408304ABD325EB20DC46BEBB7DCAB84714F10662AF599A3191EF709649C7C2
                                                        Function 00ECFDDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • __CxxThrowException@8.LIBVCRUNTIME ref: 00ED0668
                                                          • Part of subcall function 00ED32A4: RaiseException.KERNEL32(?,?,?,00ED068A,?,00F81444,?,?,?,?,?,?,00ED068A,00EB1129,00F78738,00EB1129), ref: 00ED3304
                                                        • __CxxThrowException@8.LIBVCRUNTIME ref: 00ED0685
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Exception@8Throw$ExceptionRaise
                                                        • String ID: Unknown exception
                                                        • API String ID: 3476068407-410509341
                                                        • Opcode ID: bd1fd29525a7b9ecc0d8054f586bded8493e2d1a9869fabaec8dcd8bf728c4c5
                                                        • Instruction ID: 5d31bda138b6da59d4729694a618882c6c3212ee9d9ae61ed47ff9040b8dace6
                                                        • Opcode Fuzzy Hash: bd1fd29525a7b9ecc0d8054f586bded8493e2d1a9869fabaec8dcd8bf728c4c5
                                                        • Instruction Fuzzy Hash: 12F0A434900209778B00B674E84AE9D7BADDE00354B645137B828B6AD1EF71DA178582
                                                        Function 00EB10F3 Relevance: 4.7, APIs: 3, Instructions: 153comCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EB1BC3: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00EB1BF4
                                                          • Part of subcall function 00EB1BC3: MapVirtualKeyW.USER32(00000010,00000000), ref: 00EB1BFC
                                                          • Part of subcall function 00EB1BC3: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00EB1C07
                                                          • Part of subcall function 00EB1BC3: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00EB1C12
                                                          • Part of subcall function 00EB1BC3: MapVirtualKeyW.USER32(00000011,00000000), ref: 00EB1C1A
                                                          • Part of subcall function 00EB1BC3: MapVirtualKeyW.USER32(00000012,00000000), ref: 00EB1C22
                                                          • Part of subcall function 00EB1B4A: RegisterWindowMessageW.USER32(00000004,?,00EB12C4), ref: 00EB1BA2
                                                        • GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00EB136A
                                                        • OleInitialize.OLE32 ref: 00EB1388
                                                        • CloseHandle.KERNEL32(00000000,00000000), ref: 00EF24AB
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
                                                        • String ID:
                                                        • API String ID: 1986988660-0
                                                        • Opcode ID: 40a2e4ecc230ce646dcacc6325038efc4277a4aeeead0011d9a6372e9f45b073
                                                        • Instruction ID: 5b3d96eed5c1d421c2e59fa915df14f6a2db52b46f3d3e0bdcaeab7f75f6ed34
                                                        • Opcode Fuzzy Hash: 40a2e4ecc230ce646dcacc6325038efc4277a4aeeead0011d9a6372e9f45b073
                                                        • Instruction Fuzzy Hash: F6719CB49012088EC784EF79ED566F63AE8BB89354758932AD40ADB262EB304447FF45
                                                        Function 00F1C161 Relevance: 4.6, APIs: 3, Instructions: 74timewindowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EB3923: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00EB3A04
                                                        • Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00F1C259
                                                        • KillTimer.USER32(?,00000001,?,?), ref: 00F1C261
                                                        • SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00F1C270
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: IconNotifyShell_Timer$Kill
                                                        • String ID:
                                                        • API String ID: 3500052701-0
                                                        • Opcode ID: ff38fc3a9851a3b0c577bff00362cbc1588a2c4447515eb9133ed9c3576855b7
                                                        • Instruction ID: 89c3beef2b5285e77e88eccfc3f0020a101ccf81a3fa0456a193793e32c67406
                                                        • Opcode Fuzzy Hash: ff38fc3a9851a3b0c577bff00362cbc1588a2c4447515eb9133ed9c3576855b7
                                                        • Instruction Fuzzy Hash: 6E31C371944384AFEB328F648855BEBBBECAB17304F00149ED6DAA3241C7745AC5EF91
                                                        Function 00EE86AE Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • CloseHandle.KERNELBASE(00000000,00000000,?,?,00EE85CC,?,00F78CC8,0000000C), ref: 00EE8704
                                                        • GetLastError.KERNEL32(?,00EE85CC,?,00F78CC8,0000000C), ref: 00EE870E
                                                        • __dosmaperr.LIBCMT ref: 00EE8739
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: CloseErrorHandleLast__dosmaperr
                                                        • String ID:
                                                        • API String ID: 2583163307-0
                                                        • Opcode ID: ca1942bee5b1f77918cd963e02d86da6bb6312ad99c06c22486983c793a80a3d
                                                        • Instruction ID: 056b74ed9e917358f23b678a713d47ffed8002ad4aea595cc182440883e48263
                                                        • Opcode Fuzzy Hash: ca1942bee5b1f77918cd963e02d86da6bb6312ad99c06c22486983c793a80a3d
                                                        • Instruction Fuzzy Hash: 48016B336052EC16D26062366A4577E77898B8277CF39311AF81CFB1D2DEA08C818290
                                                        Function 00EBDB38 Relevance: 4.5, APIs: 3, Instructions: 29windowsleepCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • TranslateMessage.USER32(?), ref: 00EBDB7B
                                                        • DispatchMessageW.USER32(?), ref: 00EBDB89
                                                        • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00EBDB9F
                                                        • Sleep.KERNELBASE(0000000A), ref: 00EBDBB1
                                                        • TranslateAcceleratorW.USER32(?,?,?), ref: 00F01CC9
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Message$Translate$AcceleratorDispatchPeekSleep
                                                        • String ID:
                                                        • API String ID: 3288985973-0
                                                        • Opcode ID: b709d21ea70d258b5a0032a01f4cf5feda32e5163109b04effd2bf1933ad6a0f
                                                        • Instruction ID: cea17bd176af1b57d3fb1f71a6d1f545b7f0f06881928deec4eb241262f690cb
                                                        • Opcode Fuzzy Hash: b709d21ea70d258b5a0032a01f4cf5feda32e5163109b04effd2bf1933ad6a0f
                                                        • Instruction Fuzzy Hash: 02F05E306493449BEB74CB608C89FEB77ACFB45314F105628E60AA30D0EB309489AB65
                                                        Function 00EC1310 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • __Init_thread_footer.LIBCMT ref: 00EC17F6
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Init_thread_footer
                                                        • String ID: CALL
                                                        • API String ID: 1385522511-4196123274
                                                        • Opcode ID: 78130f49761059cf5592cc55d757d8a436160b737fe4ca032c91cbdabaffeef9
                                                        • Instruction ID: 98aaae104f7b82b83b241fe395092ddab22018dbbeca4b2d11cb121d87159f45
                                                        • Opcode Fuzzy Hash: 78130f49761059cf5592cc55d757d8a436160b737fe4ca032c91cbdabaffeef9
                                                        • Instruction Fuzzy Hash: 20227C706082419FC714DF14C980F6ABBF1BF86314F18995DF496AB3A2D732E852DB92
                                                        Function 00EB2DE3 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetOpenFileNameW.COMDLG32(?), ref: 00EF2C8C
                                                          • Part of subcall function 00EB3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00EB3A97,?,?,00EB2E7F,?,?,?,00000000), ref: 00EB3AC2
                                                          • Part of subcall function 00EB2DA5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00EB2DC4
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Name$Path$FileFullLongOpen
                                                        • String ID: X
                                                        • API String ID: 779396738-3081909835
                                                        • Opcode ID: a7d63c142e50d8ed700166a2fae19c883b6707aa9d83c182932623a64c3163f1
                                                        • Instruction ID: 28f85245bc5b5f4e6c6ab80208d4dfa1c667f8b181f7975dec0a9803cb5538ad
                                                        • Opcode Fuzzy Hash: a7d63c142e50d8ed700166a2fae19c883b6707aa9d83c182932623a64c3163f1
                                                        • Instruction Fuzzy Hash: 16219371A0025C9FDB01DF94C845BEE7BF8AF49304F00905AE609F7241DBB49A499FA1
                                                        Function 00EB3837 Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • Shell_NotifyIconW.SHELL32(00000000,?), ref: 00EB3908
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: IconNotifyShell_
                                                        • String ID:
                                                        • API String ID: 1144537725-0
                                                        • Opcode ID: 0023cabf02f88cae5b72686c853d78f9702fe9f148a39ee1880993159897fcc5
                                                        • Instruction ID: d7d84ee05da531c20b32fc5663f3dc75480caf294fe5f70c3e53dd402d85f22a
                                                        • Opcode Fuzzy Hash: 0023cabf02f88cae5b72686c853d78f9702fe9f148a39ee1880993159897fcc5
                                                        • Instruction Fuzzy Hash: 2831B1705043059FD320DF34D8857E7BBE8FB49308F00092EF69993290E771AA44DB92
                                                        Function 00ECF645 Relevance: 3.0, APIs: 2, Instructions: 29sleeptimeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • timeGetTime.WINMM ref: 00ECF661
                                                          • Part of subcall function 00EBD730: GetInputState.USER32 ref: 00EBD807
                                                        • Sleep.KERNEL32(00000000), ref: 00F0F2DE
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: InputSleepStateTimetime
                                                        • String ID:
                                                        • API String ID: 4149333218-0
                                                        • Opcode ID: 8118881efa8996b50c8b160dbc934aa2d3c53c1e8a84be8abb132b2b99d8d6b5
                                                        • Instruction ID: 8765a33f6d90b4665852d60194235eaa3ea37533a2f0445558c1172c5df011c1
                                                        • Opcode Fuzzy Hash: 8118881efa8996b50c8b160dbc934aa2d3c53c1e8a84be8abb132b2b99d8d6b5
                                                        • Instruction Fuzzy Hash: 87F0A7352402059FD350EF75D445F9AB7E9FF55760F001029E85AD7361DB70A800DB91
                                                        Function 00EBB710 Relevance: 2.1, APIs: 1, Instructions: 587COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • __Init_thread_footer.LIBCMT ref: 00EBBB4E
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Init_thread_footer
                                                        • String ID:
                                                        • API String ID: 1385522511-0
                                                        • Opcode ID: 13d193dbcac92253f32fb47698919c5139e72f2a87bd18c468cdfd64c0a41a27
                                                        • Instruction ID: a27a27b236b537376042caf9d3961e655ff14f969f52dc1f5d6ac503c5e3f5ba
                                                        • Opcode Fuzzy Hash: 13d193dbcac92253f32fb47698919c5139e72f2a87bd18c468cdfd64c0a41a27
                                                        • Instruction Fuzzy Hash: 3C329B31A04209DFDB24CF54C894BFEB7B9EF44314F189069E905BB2A1CBB5AD41EB91
                                                        Function 00EB4ECB Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EB4E90: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00EB4EDD,?,00F81418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00EB4E9C
                                                          • Part of subcall function 00EB4E90: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00EB4EAE
                                                          • Part of subcall function 00EB4E90: FreeLibrary.KERNEL32(00000000,?,?,00EB4EDD,?,00F81418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00EB4EC0
                                                        • LoadLibraryExW.KERNEL32(?,00000000,00000002,?,00F81418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00EB4EFD
                                                          • Part of subcall function 00EB4E59: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00EF3CDE,?,00F81418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00EB4E62
                                                          • Part of subcall function 00EB4E59: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00EB4E74
                                                          • Part of subcall function 00EB4E59: FreeLibrary.KERNEL32(00000000,?,?,00EF3CDE,?,00F81418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00EB4E87
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Library$Load$AddressFreeProc
                                                        • String ID:
                                                        • API String ID: 2632591731-0
                                                        • Opcode ID: 31d51a5b5b808c15f51126899a0bdfb4fb8d68e4b83741d1aa42b79e8c129269
                                                        • Instruction ID: 10b7dacd4d69e5afc00e74cfcb5cbef98699604149abac0d5e482e604df77d5a
                                                        • Opcode Fuzzy Hash: 31d51a5b5b808c15f51126899a0bdfb4fb8d68e4b83741d1aa42b79e8c129269
                                                        • Instruction Fuzzy Hash: DC11C172700205AACB14BB64DD02BFE77E5AF40B10F10A42AF542BB1D2EEB0DA459B90
                                                        Function 00EE8402 Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: __wsopen_s
                                                        • String ID:
                                                        • API String ID: 3347428461-0
                                                        • Opcode ID: 57879157ca4b86cd5cb6062eccba1b2165c0592962d5d39b13f7ad48038d2782
                                                        • Instruction ID: d6fc8212e219d6be2249333e13f2f772ac1a432589f3d76446c690e8ce5c6df8
                                                        • Opcode Fuzzy Hash: 57879157ca4b86cd5cb6062eccba1b2165c0592962d5d39b13f7ad48038d2782
                                                        • Instruction Fuzzy Hash: F011187590410EAFCB05DF59E9419EE7BF5EF48314F104059F818AB352DA31DA11CBA5
                                                        Function 00EE5000 Relevance: 1.6, APIs: 1, Instructions: 52COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EE4C7D: RtlAllocateHeap.NTDLL(00000008,00EB1129,00000000,?,00EE2E29,00000001,00000364,?,?,?,00EDF2DE,00EE3863,00F81444,?,00ECFDF5,?), ref: 00EE4CBE
                                                        • _free.LIBCMT ref: 00EE506C
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: AllocateHeap_free
                                                        • String ID:
                                                        • API String ID: 614378929-0
                                                        • Opcode ID: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
                                                        • Instruction ID: 963d3d8914faf2a72cc941b6525f9b1aa7ccf0c8759e919af123ad23492daf39
                                                        • Opcode Fuzzy Hash: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
                                                        • Instruction Fuzzy Hash: C90126732047486BE3218E669885A9AFBECFB89374F25051DF194A32C0EA70A905C6B4
                                                        Function 00F429BF Relevance: 1.5, APIs: 1, Instructions: 48COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetForegroundWindow.USER32(00000000,?,?,?,00F414B5,?), ref: 00F42A01
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: ForegroundWindow
                                                        • String ID:
                                                        • API String ID: 2020703349-0
                                                        • Opcode ID: 382ec36a4a3e82eb92c24bbb6fcf773dfdec3233ecd27ede2cdcb0a7546f1acb
                                                        • Instruction ID: 83ac06d729f9728c7ae2ecaae0e95dc055053a36742e88cf6ec9083ca63258e2
                                                        • Opcode Fuzzy Hash: 382ec36a4a3e82eb92c24bbb6fcf773dfdec3233ecd27ede2cdcb0a7546f1acb
                                                        • Instruction Fuzzy Hash: 7D01B5367006419FD3A4CA2CC494B223B92EF85324FA98478EC478B251D73AEC42E7A0
                                                        Function 00EDE602 Relevance: 1.5, APIs: 1, Instructions: 46COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
                                                        • Instruction ID: abd21c0fde4d2215804bf7c06b2e90c166ff3798f4b18d56d579138c9b0c2cd8
                                                        • Opcode Fuzzy Hash: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
                                                        • Instruction Fuzzy Hash: 93F0F432510A1896D6313A6A8D09B9A33DCDF92338F10275BF535BA3D2DB74E80386A5
                                                        Function 00EE4C7D Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • RtlAllocateHeap.NTDLL(00000008,00EB1129,00000000,?,00EE2E29,00000001,00000364,?,?,?,00EDF2DE,00EE3863,00F81444,?,00ECFDF5,?), ref: 00EE4CBE
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: AllocateHeap
                                                        • String ID:
                                                        • API String ID: 1279760036-0
                                                        • Opcode ID: c5b722fd0a9fba6b57b700303c22422c79b11c8264991448b2d726afc198e52f
                                                        • Instruction ID: 219751c1f2bb5334159d7f1d946fabb45fe898be1143441d1173c1907570e5c5
                                                        • Opcode Fuzzy Hash: c5b722fd0a9fba6b57b700303c22422c79b11c8264991448b2d726afc198e52f
                                                        • Instruction Fuzzy Hash: 49F0967160216C67EB215F639C05F56B7C8AB51764B387112A815B76D1CA30D80196D0
                                                        Function 00EE3820 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • RtlAllocateHeap.NTDLL(00000000,?,00F81444,?,00ECFDF5,?,?,00EBA976,00000010,00F81440,00EB13FC,?,00EB13C6,?,00EB1129), ref: 00EE3852
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: AllocateHeap
                                                        • String ID:
                                                        • API String ID: 1279760036-0
                                                        • Opcode ID: 47b5d040fa68b372001340d9464dfa021331003f2f14c0c677175929582c985c
                                                        • Instruction ID: 188703db140547998a88b0c9c7abd40d204ffbeb91fcf356e4a6dbc6b0aeb74d
                                                        • Opcode Fuzzy Hash: 47b5d040fa68b372001340d9464dfa021331003f2f14c0c677175929582c985c
                                                        • Instruction Fuzzy Hash: 5DE0E5311016AC67D63526779C09BDA37C8EB827B4F153322BC05B75D1CB20DD0282E8
                                                        Function 00EB4F39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • FreeLibrary.KERNEL32(?,?,00F81418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00EB4F6D
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: FreeLibrary
                                                        • String ID:
                                                        • API String ID: 3664257935-0
                                                        • Opcode ID: a860c01cdd40a82cfd3b5179b1d4111227648ae3c9e80b2e1c6ae596194f9c1e
                                                        • Instruction ID: f180ed2d737033c45faf1af5a5abc8d20736903a8f4c2a9d4719669a39cf1241
                                                        • Opcode Fuzzy Hash: a860c01cdd40a82cfd3b5179b1d4111227648ae3c9e80b2e1c6ae596194f9c1e
                                                        • Instruction Fuzzy Hash: 18F085B0205312CFDB349F60D4908A3BBE0FF10329320A96EE1EAA3662C7319844DF00
                                                        Function 00F42A55 Relevance: 1.5, APIs: 1, Instructions: 25COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • IsWindow.USER32(00000000), ref: 00F42A66
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Window
                                                        • String ID:
                                                        • API String ID: 2353593579-0
                                                        • Opcode ID: c9f1d541b68b065369d4613127690e9f89c63eddb5913a22b6849f196fe3d02f
                                                        • Instruction ID: 023cd4a9c766c43ce813ae02799ba395ed42cb11052760bc6e9812ee0474333d
                                                        • Opcode Fuzzy Hash: c9f1d541b68b065369d4613127690e9f89c63eddb5913a22b6849f196fe3d02f
                                                        • Instruction Fuzzy Hash: 10E0DF3635012AAAC790EA30EC849FA775CEB603917404436BC1AC3100DF389A82A2E0
                                                        Function 00EB30F2 Relevance: 1.5, APIs: 1, Instructions: 24windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • Shell_NotifyIconW.SHELL32(00000002,?), ref: 00EB314E
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: IconNotifyShell_
                                                        • String ID:
                                                        • API String ID: 1144537725-0
                                                        • Opcode ID: 5c17722e869913ecf12c3d0ba4b0ae2b2b1a41fe53e026b948f38c5fda016063
                                                        • Instruction ID: 0126515c37b4fcc2187a21bde7a2ebfa32886226eb7ce5259d397ff39c3247c5
                                                        • Opcode Fuzzy Hash: 5c17722e869913ecf12c3d0ba4b0ae2b2b1a41fe53e026b948f38c5fda016063
                                                        • Instruction Fuzzy Hash: FFF037709143189FE752DB24DC467E67BFCB70170CF0001E9A648A6291D7745789DF51
                                                        Function 00EB2DA5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00EB2DC4
                                                          • Part of subcall function 00EB6B57: _wcslen.LIBCMT ref: 00EB6B6A
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: LongNamePath_wcslen
                                                        • String ID:
                                                        • API String ID: 541455249-0
                                                        • Opcode ID: 9aec8c6be4978e0c393a7dd453479a3603b39565ac6391bf6a0b614d6833ad9b
                                                        • Instruction ID: 88870b110a7cfefd3954a40469cf1cb1080822435b7372a2d520faa89aada20a
                                                        • Opcode Fuzzy Hash: 9aec8c6be4978e0c393a7dd453479a3603b39565ac6391bf6a0b614d6833ad9b
                                                        • Instruction Fuzzy Hash: B6E0CD766011285BC71092589C05FEA77EDDFC8790F0500B1FD09E7248D9A4AD808590
                                                        Function 00EB2B3D Relevance: 1.5, APIs: 1, Instructions: 22COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EB3837: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00EB3908
                                                          • Part of subcall function 00EBD730: GetInputState.USER32 ref: 00EBD807
                                                        • SetCurrentDirectoryW.KERNEL32(?), ref: 00EB2B6B
                                                          • Part of subcall function 00EB30F2: Shell_NotifyIconW.SHELL32(00000002,?), ref: 00EB314E
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: IconNotifyShell_$CurrentDirectoryInputState
                                                        • String ID:
                                                        • API String ID: 3667716007-0
                                                        • Opcode ID: 49944721876957172361eba968e36d1433bd2e01368b6c8bde2007257fef7402
                                                        • Instruction ID: 25f0bb64c755d439431bf15611a88218fb30bc0e8899e7c7b9b2988adafc181c
                                                        • Opcode Fuzzy Hash: 49944721876957172361eba968e36d1433bd2e01368b6c8bde2007257fef7402
                                                        • Instruction Fuzzy Hash: 74E0862530424806CA08BB7498535FFB7D99FD2355F40363EF542A31A3DE2445464352
                                                        Function 00EF039A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • CreateFileW.KERNELBASE(00000000,00000000,?,00EF0704,?,?,00000000,?,00EF0704,00000000,0000000C), ref: 00EF03B7
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: CreateFile
                                                        • String ID:
                                                        • API String ID: 823142352-0
                                                        • Opcode ID: c8739f8648ce2ed3b2203aa1a29d05e342ea41591a7d1a7e9478d657f8fe6f26
                                                        • Instruction ID: e5054f69853299d75313eece56791018ce857e5270c1874b59d3e21f1001b8c5
                                                        • Opcode Fuzzy Hash: c8739f8648ce2ed3b2203aa1a29d05e342ea41591a7d1a7e9478d657f8fe6f26
                                                        • Instruction Fuzzy Hash: 33D06C3204010DBBDF028F84DD06EDA3BAAFB88714F014000BE1856020C732E821AB90
                                                        Function 00EB1CAD Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SystemParametersInfoW.USER32(00002001,00000000,00000002), ref: 00EB1CBC
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: InfoParametersSystem
                                                        • String ID:
                                                        • API String ID: 3098949447-0
                                                        • Opcode ID: 65f51c38636fc508d68742eb3df6a28f26b6a300fc837202564ae3bc6273c091
                                                        • Instruction ID: 6551f9c887f11a69437ae2362a9892819851219d35ffbd6f37b0a157947bdaea
                                                        • Opcode Fuzzy Hash: 65f51c38636fc508d68742eb3df6a28f26b6a300fc837202564ae3bc6273c091
                                                        • Instruction Fuzzy Hash: 84C09B352C030C9FF2544780FC4EFA47754B358B00F084001F709595E3D7A12410F750

                                                        Non-executed Functions

                                                        Function 00F49576 Relevance: 72.4, APIs: 39, Strings: 2, Instructions: 625windowkeyboardCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EC9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00EC9BB2
                                                        • DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 00F4961A
                                                        • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00F4965B
                                                        • GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 00F4969F
                                                        • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00F496C9
                                                        • SendMessageW.USER32 ref: 00F496F2
                                                        • GetKeyState.USER32(00000011), ref: 00F4978B
                                                        • GetKeyState.USER32(00000009), ref: 00F49798
                                                        • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00F497AE
                                                        • GetKeyState.USER32(00000010), ref: 00F497B8
                                                        • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00F497E9
                                                        • SendMessageW.USER32 ref: 00F49810
                                                        • SendMessageW.USER32(?,00001030,?,00F47E95), ref: 00F49918
                                                        • ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 00F4992E
                                                        • ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00F49941
                                                        • SetCapture.USER32(?), ref: 00F4994A
                                                        • ClientToScreen.USER32(?,?), ref: 00F499AF
                                                        • ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 00F499BC
                                                        • InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00F499D6
                                                        • ReleaseCapture.USER32 ref: 00F499E1
                                                        • GetCursorPos.USER32(?), ref: 00F49A19
                                                        • ScreenToClient.USER32(?,?), ref: 00F49A26
                                                        • SendMessageW.USER32(?,00001012,00000000,?), ref: 00F49A80
                                                        • SendMessageW.USER32 ref: 00F49AAE
                                                        • SendMessageW.USER32(?,00001111,00000000,?), ref: 00F49AEB
                                                        • SendMessageW.USER32 ref: 00F49B1A
                                                        • SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00F49B3B
                                                        • SendMessageW.USER32(?,0000110B,00000009,?), ref: 00F49B4A
                                                        • GetCursorPos.USER32(?), ref: 00F49B68
                                                        • ScreenToClient.USER32(?,?), ref: 00F49B75
                                                        • GetParent.USER32(?), ref: 00F49B93
                                                        • SendMessageW.USER32(?,00001012,00000000,?), ref: 00F49BFA
                                                        • SendMessageW.USER32 ref: 00F49C2B
                                                        • ClientToScreen.USER32(?,?), ref: 00F49C84
                                                        • TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00F49CB4
                                                        • SendMessageW.USER32(?,00001111,00000000,?), ref: 00F49CDE
                                                        • SendMessageW.USER32 ref: 00F49D01
                                                        • ClientToScreen.USER32(?,?), ref: 00F49D4E
                                                        • TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00F49D82
                                                          • Part of subcall function 00EC9944: GetWindowLongW.USER32(?,000000EB), ref: 00EC9952
                                                        • GetWindowLongW.USER32(?,000000F0), ref: 00F49E05
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease
                                                        • String ID: @GUI_DRAGID$F
                                                        • API String ID: 3429851547-4164748364
                                                        • Opcode ID: f7c408f7326fc1a54c974f12ac4fd30ec116839e6331573edd3b7d59f21e5a14
                                                        • Instruction ID: 9d64922815cb0dfd18708f4ebab5ddafe385198dd07d92aa5c1558c24944561e
                                                        • Opcode Fuzzy Hash: f7c408f7326fc1a54c974f12ac4fd30ec116839e6331573edd3b7d59f21e5a14
                                                        • Instruction Fuzzy Hash: AE42AD34608205AFDB20CF24CC44EABBFE5FF49320F154619FA99972A1D7B1A851EF91
                                                        Function 00F44873 Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 566windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SendMessageW.USER32(00000000,00000408,00000000,00000000), ref: 00F448F3
                                                        • SendMessageW.USER32(00000000,00000188,00000000,00000000), ref: 00F44908
                                                        • SendMessageW.USER32(00000000,0000018A,00000000,00000000), ref: 00F44927
                                                        • SendMessageW.USER32(?,00000148,00000000,00000000), ref: 00F4494B
                                                        • SendMessageW.USER32(00000000,00000147,00000000,00000000), ref: 00F4495C
                                                        • SendMessageW.USER32(00000000,00000149,00000000,00000000), ref: 00F4497B
                                                        • SendMessageW.USER32(00000000,0000130B,00000000,00000000), ref: 00F449AE
                                                        • SendMessageW.USER32(00000000,0000133C,00000000,?), ref: 00F449D4
                                                        • SendMessageW.USER32(00000000,0000110A,00000009,00000000), ref: 00F44A0F
                                                        • SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00F44A56
                                                        • SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00F44A7E
                                                        • IsMenu.USER32(?), ref: 00F44A97
                                                        • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00F44AF2
                                                        • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00F44B20
                                                        • GetWindowLongW.USER32(?,000000F0), ref: 00F44B94
                                                        • SendMessageW.USER32(?,0000113E,00000000,00000008), ref: 00F44BE3
                                                        • SendMessageW.USER32(00000000,00001001,00000000,?), ref: 00F44C82
                                                        • wsprintfW.USER32 ref: 00F44CAE
                                                        • SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00F44CC9
                                                        • GetWindowTextW.USER32(?,00000000,00000001), ref: 00F44CF1
                                                        • SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00F44D13
                                                        • SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00F44D33
                                                        • GetWindowTextW.USER32(?,00000000,00000001), ref: 00F44D5A
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: MessageSend$MenuWindow$InfoItemText$Longwsprintf
                                                        • String ID: %d/%02d/%02d
                                                        • API String ID: 4054740463-328681919
                                                        • Opcode ID: 756f58c04737754436a4be3fa812aaec2db2253c2d6d6b25fc99e979daf78a38
                                                        • Instruction ID: 3485d790aeb3d105b35c3b2f6fbb094e924c14299f63605677dd41bce1763c49
                                                        • Opcode Fuzzy Hash: 756f58c04737754436a4be3fa812aaec2db2253c2d6d6b25fc99e979daf78a38
                                                        • Instruction Fuzzy Hash: DC12CF75A00218ABEB249F24CC49FAE7FF8EB45720F144129FD19EB2E1D774A941EB50
                                                        Function 00ECF98E Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetForegroundWindow.USER32(00000000,00000000,00000000), ref: 00ECF998
                                                        • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00F0F474
                                                        • IsIconic.USER32(00000000), ref: 00F0F47D
                                                        • ShowWindow.USER32(00000000,00000009), ref: 00F0F48A
                                                        • SetForegroundWindow.USER32(00000000), ref: 00F0F494
                                                        • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00F0F4AA
                                                        • GetCurrentThreadId.KERNEL32 ref: 00F0F4B1
                                                        • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00F0F4BD
                                                        • AttachThreadInput.USER32(?,00000000,00000001), ref: 00F0F4CE
                                                        • AttachThreadInput.USER32(?,00000000,00000001), ref: 00F0F4D6
                                                        • AttachThreadInput.USER32(00000000,000000FF,00000001), ref: 00F0F4DE
                                                        • SetForegroundWindow.USER32(00000000), ref: 00F0F4E1
                                                        • MapVirtualKeyW.USER32(00000012,00000000), ref: 00F0F4F6
                                                        • keybd_event.USER32(00000012,00000000), ref: 00F0F501
                                                        • MapVirtualKeyW.USER32(00000012,00000000), ref: 00F0F50B
                                                        • keybd_event.USER32(00000012,00000000), ref: 00F0F510
                                                        • MapVirtualKeyW.USER32(00000012,00000000), ref: 00F0F519
                                                        • keybd_event.USER32(00000012,00000000), ref: 00F0F51E
                                                        • MapVirtualKeyW.USER32(00000012,00000000), ref: 00F0F528
                                                        • keybd_event.USER32(00000012,00000000), ref: 00F0F52D
                                                        • SetForegroundWindow.USER32(00000000), ref: 00F0F530
                                                        • AttachThreadInput.USER32(?,000000FF,00000000), ref: 00F0F557
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
                                                        • String ID: Shell_TrayWnd
                                                        • API String ID: 4125248594-2988720461
                                                        • Opcode ID: 1adc344d06cab314148da67e1f761c3da4f759f48b26d353a7c5ffa0232d3589
                                                        • Instruction ID: b2b791d328e192b498319858578f50bbb92a8b0c7c149686240d4c7e583394fb
                                                        • Opcode Fuzzy Hash: 1adc344d06cab314148da67e1f761c3da4f759f48b26d353a7c5ffa0232d3589
                                                        • Instruction Fuzzy Hash: EA317075A4121CBBEB306BB59C4AFBF7E6CEB45B50F141026FE04E61D1C6B16D00BAA1
                                                        Function 00F11201 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 241COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00F116C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00F1170D
                                                          • Part of subcall function 00F116C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00F1173A
                                                          • Part of subcall function 00F116C3: GetLastError.KERNEL32 ref: 00F1174A
                                                        • LogonUserW.ADVAPI32(?,?,?,00000000,00000000,?), ref: 00F11286
                                                        • DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 00F112A8
                                                        • CloseHandle.KERNEL32(?), ref: 00F112B9
                                                        • OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00F112D1
                                                        • GetProcessWindowStation.USER32 ref: 00F112EA
                                                        • SetProcessWindowStation.USER32(00000000), ref: 00F112F4
                                                        • OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00F11310
                                                          • Part of subcall function 00F110BF: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00F111FC), ref: 00F110D4
                                                          • Part of subcall function 00F110BF: CloseHandle.KERNEL32(?,?,00F111FC), ref: 00F110E9
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLogonLookupPrivilegeUserValue
                                                        • String ID: $default$winsta0
                                                        • API String ID: 22674027-1027155976
                                                        • Opcode ID: 31d7dddedb8112000878979a56312ba4c965bc855a06c6cf9e00ae342240f4eb
                                                        • Instruction ID: 57c0becbb54ff63a47ae8180fdbb0019cd0dda86cdd28d040dd8d0c7fb9b4c6a
                                                        • Opcode Fuzzy Hash: 31d7dddedb8112000878979a56312ba4c965bc855a06c6cf9e00ae342240f4eb
                                                        • Instruction Fuzzy Hash: C7819D71900209AFDF20DFA4DC49FEE7BB9FF06B10F144129FA14A62A0D7758994EB61
                                                        Function 00F10B62 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00F110F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00F11114
                                                          • Part of subcall function 00F110F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00F10B9B,?,?,?), ref: 00F11120
                                                          • Part of subcall function 00F110F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00F10B9B,?,?,?), ref: 00F1112F
                                                          • Part of subcall function 00F110F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00F10B9B,?,?,?), ref: 00F11136
                                                          • Part of subcall function 00F110F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00F1114D
                                                        • GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00F10BCC
                                                        • GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00F10C00
                                                        • GetLengthSid.ADVAPI32(?), ref: 00F10C17
                                                        • GetAce.ADVAPI32(?,00000000,?), ref: 00F10C51
                                                        • AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00F10C6D
                                                        • GetLengthSid.ADVAPI32(?), ref: 00F10C84
                                                        • GetProcessHeap.KERNEL32(00000008,00000008), ref: 00F10C8C
                                                        • HeapAlloc.KERNEL32(00000000), ref: 00F10C93
                                                        • GetLengthSid.ADVAPI32(?,00000008,?), ref: 00F10CB4
                                                        • CopySid.ADVAPI32(00000000), ref: 00F10CBB
                                                        • AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00F10CEA
                                                        • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00F10D0C
                                                        • SetUserObjectSecurity.USER32(?,00000004,?), ref: 00F10D1E
                                                        • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00F10D45
                                                        • HeapFree.KERNEL32(00000000), ref: 00F10D4C
                                                        • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00F10D55
                                                        • HeapFree.KERNEL32(00000000), ref: 00F10D5C
                                                        • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00F10D65
                                                        • HeapFree.KERNEL32(00000000), ref: 00F10D6C
                                                        • GetProcessHeap.KERNEL32(00000000,?), ref: 00F10D78
                                                        • HeapFree.KERNEL32(00000000), ref: 00F10D7F
                                                          • Part of subcall function 00F11193: GetProcessHeap.KERNEL32(00000008,00F10BB1,?,00000000,?,00F10BB1,?), ref: 00F111A1
                                                          • Part of subcall function 00F11193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00F10BB1,?), ref: 00F111A8
                                                          • Part of subcall function 00F11193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00F10BB1,?), ref: 00F111B7
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
                                                        • String ID:
                                                        • API String ID: 4175595110-0
                                                        • Opcode ID: eb4b0b487161c5abf03b9da1c2d36ba6251e39c17d21f91f7f5845cb2067407c
                                                        • Instruction ID: fa7e9d8ccf9e4669cec02d0789fdfaf8669b34ac6898a4782a656ad78fdaacdb
                                                        • Opcode Fuzzy Hash: eb4b0b487161c5abf03b9da1c2d36ba6251e39c17d21f91f7f5845cb2067407c
                                                        • Instruction Fuzzy Hash: D8718CB6D0120AABDF10DFA5EC44FEEBBB8BF15310F044115E914E6191DBB1A985EBA0
                                                        Function 00F2EAFF Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • OpenClipboard.USER32(00F4CC08), ref: 00F2EB29
                                                        • IsClipboardFormatAvailable.USER32(0000000D), ref: 00F2EB37
                                                        • GetClipboardData.USER32(0000000D), ref: 00F2EB43
                                                        • CloseClipboard.USER32 ref: 00F2EB4F
                                                        • GlobalLock.KERNEL32(00000000), ref: 00F2EB87
                                                        • CloseClipboard.USER32 ref: 00F2EB91
                                                        • GlobalUnlock.KERNEL32(00000000), ref: 00F2EBBC
                                                        • IsClipboardFormatAvailable.USER32(00000001), ref: 00F2EBC9
                                                        • GetClipboardData.USER32(00000001), ref: 00F2EBD1
                                                        • GlobalLock.KERNEL32(00000000), ref: 00F2EBE2
                                                        • GlobalUnlock.KERNEL32(00000000), ref: 00F2EC22
                                                        • IsClipboardFormatAvailable.USER32(0000000F), ref: 00F2EC38
                                                        • GetClipboardData.USER32(0000000F), ref: 00F2EC44
                                                        • GlobalLock.KERNEL32(00000000), ref: 00F2EC55
                                                        • DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 00F2EC77
                                                        • DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 00F2EC94
                                                        • DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 00F2ECD2
                                                        • GlobalUnlock.KERNEL32(00000000), ref: 00F2ECF3
                                                        • CountClipboardFormats.USER32 ref: 00F2ED14
                                                        • CloseClipboard.USER32 ref: 00F2ED59
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
                                                        • String ID:
                                                        • API String ID: 420908878-0
                                                        • Opcode ID: 94ec57d67351689881fb80ea8436e1441a0dae0468196ab0dfa82c559bc6e5aa
                                                        • Instruction ID: 93fe08d8d0eea2135a05dfc9b25a1f0d1226a196810014a5c58e81ba5485eb01
                                                        • Opcode Fuzzy Hash: 94ec57d67351689881fb80ea8436e1441a0dae0468196ab0dfa82c559bc6e5aa
                                                        • Instruction Fuzzy Hash: 016123352043059FD300EF20E884F6ABBE4EF95710F64541DF846972A2CB71DD05EBA2
                                                        Function 00F2698F Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • FindFirstFileW.KERNEL32(?,?), ref: 00F269BE
                                                        • FindClose.KERNEL32(00000000), ref: 00F26A12
                                                        • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00F26A4E
                                                        • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00F26A75
                                                          • Part of subcall function 00EB9CB3: _wcslen.LIBCMT ref: 00EB9CBD
                                                        • FileTimeToSystemTime.KERNEL32(?,?), ref: 00F26AB2
                                                        • FileTimeToSystemTime.KERNEL32(?,?), ref: 00F26ADF
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
                                                        • String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
                                                        • API String ID: 3830820486-3289030164
                                                        • Opcode ID: ab1e41bc504278751a29e08f5d8d8796a69ff1e9278db6a021939ebae2568a02
                                                        • Instruction ID: 6c89d4a81ce66b1e5ed4c27a06181407d92098145aa7b36f8c26c4c501bf6f61
                                                        • Opcode Fuzzy Hash: ab1e41bc504278751a29e08f5d8d8796a69ff1e9278db6a021939ebae2568a02
                                                        • Instruction Fuzzy Hash: B8D17172508300AFC314EBA4D991EAFB7ECAF98704F04591DF589D7192EB74DA44CBA2
                                                        Function 00F29642 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00F29663
                                                        • GetFileAttributesW.KERNEL32(?), ref: 00F296A1
                                                        • SetFileAttributesW.KERNEL32(?,?), ref: 00F296BB
                                                        • FindNextFileW.KERNEL32(00000000,?), ref: 00F296D3
                                                        • FindClose.KERNEL32(00000000), ref: 00F296DE
                                                        • FindFirstFileW.KERNEL32(*.*,?), ref: 00F296FA
                                                        • SetCurrentDirectoryW.KERNEL32(?), ref: 00F2974A
                                                        • SetCurrentDirectoryW.KERNEL32(00F76B7C), ref: 00F29768
                                                        • FindNextFileW.KERNEL32(00000000,00000010), ref: 00F29772
                                                        • FindClose.KERNEL32(00000000), ref: 00F2977F
                                                        • FindClose.KERNEL32(00000000), ref: 00F2978F
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
                                                        • String ID: *.*
                                                        • API String ID: 1409584000-438819550
                                                        • Opcode ID: bc59658b59dd8d70a211b9891b125c27af045afe4684892792f80e93846044d3
                                                        • Instruction ID: 81c641333f5a63e9ede9ae4d80bbfa80fa7ee1d7141daa8c0300cf6872b366d4
                                                        • Opcode Fuzzy Hash: bc59658b59dd8d70a211b9891b125c27af045afe4684892792f80e93846044d3
                                                        • Instruction Fuzzy Hash: 3F31C5369056296BDF109FB4EC48ADE77BCAF4A320F104156F915E31A0DBB0DA44AA54
                                                        Function 00F2979D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00F297BE
                                                        • FindNextFileW.KERNEL32(00000000,?), ref: 00F29819
                                                        • FindClose.KERNEL32(00000000), ref: 00F29824
                                                        • FindFirstFileW.KERNEL32(*.*,?), ref: 00F29840
                                                        • SetCurrentDirectoryW.KERNEL32(?), ref: 00F29890
                                                        • SetCurrentDirectoryW.KERNEL32(00F76B7C), ref: 00F298AE
                                                        • FindNextFileW.KERNEL32(00000000,00000010), ref: 00F298B8
                                                        • FindClose.KERNEL32(00000000), ref: 00F298C5
                                                        • FindClose.KERNEL32(00000000), ref: 00F298D5
                                                          • Part of subcall function 00F1DAE5: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00F1DB00
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
                                                        • String ID: *.*
                                                        • API String ID: 2640511053-438819550
                                                        • Opcode ID: f823a5f95cd78e214d5252877c74b96e3662ebb50d7c42fe31ed8030b6869c3a
                                                        • Instruction ID: b2967752d0f94600eca494ce7a12291eb0366517d03c160c911f3aab4d23f3b8
                                                        • Opcode Fuzzy Hash: f823a5f95cd78e214d5252877c74b96e3662ebb50d7c42fe31ed8030b6869c3a
                                                        • Instruction Fuzzy Hash: 4F31F63290562D6ADB14EFB4EC48ADE37BCEF46330F144156E914E31A0DBB0DA85EA60
                                                        Function 00F3BE44 Relevance: 17.0, APIs: 11, Instructions: 456registryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00F3C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00F3B6AE,?,?), ref: 00F3C9B5
                                                          • Part of subcall function 00F3C998: _wcslen.LIBCMT ref: 00F3C9F1
                                                          • Part of subcall function 00F3C998: _wcslen.LIBCMT ref: 00F3CA68
                                                          • Part of subcall function 00F3C998: _wcslen.LIBCMT ref: 00F3CA9E
                                                        • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00F3BF3E
                                                        • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?), ref: 00F3BFA9
                                                        • RegCloseKey.ADVAPI32(00000000), ref: 00F3BFCD
                                                        • RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00F3C02C
                                                        • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 00F3C0E7
                                                        • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00F3C154
                                                        • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00F3C1E9
                                                        • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,?,?,00000000), ref: 00F3C23A
                                                        • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00F3C2E3
                                                        • RegCloseKey.ADVAPI32(?,?,00000000), ref: 00F3C382
                                                        • RegCloseKey.ADVAPI32(00000000), ref: 00F3C38F
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: QueryValue$Close_wcslen$BuffCharConnectOpenRegistryUpper
                                                        • String ID:
                                                        • API String ID: 3102970594-0
                                                        • Opcode ID: d95a49c68ef57596e0e7c08e341822718ecdf8fe8e907e2d6da845509deff7b4
                                                        • Instruction ID: 7972fd7aa2946ffcc65844831213707b4acfa90c72f24999245682e67567c043
                                                        • Opcode Fuzzy Hash: d95a49c68ef57596e0e7c08e341822718ecdf8fe8e907e2d6da845509deff7b4
                                                        • Instruction Fuzzy Hash: 13025F716042009FD714DF28C895E2ABBE5EF89324F18C49DF84ADB2A2DB31ED45DB91
                                                        Function 00F28195 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetLocalTime.KERNEL32(?), ref: 00F28257
                                                        • SystemTimeToFileTime.KERNEL32(?,?), ref: 00F28267
                                                        • LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00F28273
                                                        • GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00F28310
                                                        • SetCurrentDirectoryW.KERNEL32(?), ref: 00F28324
                                                        • SetCurrentDirectoryW.KERNEL32(?), ref: 00F28356
                                                        • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00F2838C
                                                        • SetCurrentDirectoryW.KERNEL32(?), ref: 00F28395
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: CurrentDirectoryTime$File$Local$System
                                                        • String ID: *.*
                                                        • API String ID: 1464919966-438819550
                                                        • Opcode ID: df130ebd02a09bfeaf449e5cce45dae8e48a135f0e38f7c8fe0323f72fa64ebd
                                                        • Instruction ID: aa1a27c73cef6c717c724c5b270151c54bd47e3a00f546e7706315e38ab559e1
                                                        • Opcode Fuzzy Hash: df130ebd02a09bfeaf449e5cce45dae8e48a135f0e38f7c8fe0323f72fa64ebd
                                                        • Instruction Fuzzy Hash: 916169725083159FC710EF60D8409AFB3E8FF89360F04892AF98997251EB35E946CB92
                                                        Function 00F1D076 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EB3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00EB3A97,?,?,00EB2E7F,?,?,?,00000000), ref: 00EB3AC2
                                                          • Part of subcall function 00F1E199: GetFileAttributesW.KERNEL32(?,00F1CF95), ref: 00F1E19A
                                                        • FindFirstFileW.KERNEL32(?,?), ref: 00F1D122
                                                        • DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 00F1D1DD
                                                        • MoveFileW.KERNEL32(?,?), ref: 00F1D1F0
                                                        • DeleteFileW.KERNEL32(?,?,?,?), ref: 00F1D20D
                                                        • FindNextFileW.KERNEL32(00000000,00000010), ref: 00F1D237
                                                          • Part of subcall function 00F1D29C: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,00F1D21C,?,?), ref: 00F1D2B2
                                                        • FindClose.KERNEL32(00000000,?,?,?), ref: 00F1D253
                                                        • FindClose.KERNEL32(00000000), ref: 00F1D264
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
                                                        • String ID: \*.*
                                                        • API String ID: 1946585618-1173974218
                                                        • Opcode ID: 1f98ccd0701a643063e2d138d2be5f184ab21790445d1f3f790808b6aa0e4a59
                                                        • Instruction ID: e87168e22b3b64d318dd2144ebd56db4777a3838a5ac7d4c4d361e8950e4f62a
                                                        • Opcode Fuzzy Hash: 1f98ccd0701a643063e2d138d2be5f184ab21790445d1f3f790808b6aa0e4a59
                                                        • Instruction Fuzzy Hash: A7617C31C0114DABCF05EBE0DE929EEB7B5AF55300F245169E81277192EB346F49EB60
                                                        Function 00F2ED6A Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Clipboard$AllocCloseEmptyGlobalOpen
                                                        • String ID:
                                                        • API String ID: 1737998785-0
                                                        • Opcode ID: bad8abf9e541ef39adf299b2c55b86449cb38bf019235ab6c292748905dd5537
                                                        • Instruction ID: a08ed1481a9736ee828627b17675b9893759bd23b47114f8e5837f3cc7f4878a
                                                        • Opcode Fuzzy Hash: bad8abf9e541ef39adf299b2c55b86449cb38bf019235ab6c292748905dd5537
                                                        • Instruction Fuzzy Hash: F841DF356056219FD310CF15E848B6ABBE1FF54328F26D099E8198B762C771EC41DBD0
                                                        Function 00F1E8F6 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00F116C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00F1170D
                                                          • Part of subcall function 00F116C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00F1173A
                                                          • Part of subcall function 00F116C3: GetLastError.KERNEL32 ref: 00F1174A
                                                        • ExitWindowsEx.USER32(?,00000000), ref: 00F1E932
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
                                                        • String ID: $ $@$SeShutdownPrivilege
                                                        • API String ID: 2234035333-3163812486
                                                        • Opcode ID: 0671a0bb26878217c321eba0a8ed0c6792a0058cd0d4631804e6fe4f1f4d5a0f
                                                        • Instruction ID: 4c98920eefd9c1552f56f035224294f8ebb043ce2f10408d038dfd91798fbed8
                                                        • Opcode Fuzzy Hash: 0671a0bb26878217c321eba0a8ed0c6792a0058cd0d4631804e6fe4f1f4d5a0f
                                                        • Instruction Fuzzy Hash: 7E014933A10315ABEB6422B49C86FFF726CAB18750F540422FD03E30D1D5A95CC0B6E0
                                                        Function 00F31204 Relevance: 12.1, APIs: 8, Instructions: 113networkCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00F31276
                                                        • WSAGetLastError.WSOCK32 ref: 00F31283
                                                        • bind.WSOCK32(00000000,?,00000010), ref: 00F312BA
                                                        • WSAGetLastError.WSOCK32 ref: 00F312C5
                                                        • closesocket.WSOCK32(00000000), ref: 00F312F4
                                                        • listen.WSOCK32(00000000,00000005), ref: 00F31303
                                                        • WSAGetLastError.WSOCK32 ref: 00F3130D
                                                        • closesocket.WSOCK32(00000000), ref: 00F3133C
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: ErrorLast$closesocket$bindlistensocket
                                                        • String ID:
                                                        • API String ID: 540024437-0
                                                        • Opcode ID: 2cb5581a47f9b482e8d04c67e95871ed3b1557455ebc603b381fce087583db35
                                                        • Instruction ID: e25606e0c82d994172096737d716379256041336dd090460cc12b01015469b1f
                                                        • Opcode Fuzzy Hash: 2cb5581a47f9b482e8d04c67e95871ed3b1557455ebc603b381fce087583db35
                                                        • Instruction Fuzzy Hash: 93418135A001049FD710DF64C488B6ABBE6BF86328F188198E8569F2D6C775ED81DBE1
                                                        Function 00F1D3A9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EB3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00EB3A97,?,?,00EB2E7F,?,?,?,00000000), ref: 00EB3AC2
                                                          • Part of subcall function 00F1E199: GetFileAttributesW.KERNEL32(?,00F1CF95), ref: 00F1E19A
                                                        • FindFirstFileW.KERNEL32(?,?), ref: 00F1D420
                                                        • DeleteFileW.KERNEL32(?,?,?,?), ref: 00F1D470
                                                        • FindNextFileW.KERNEL32(00000000,00000010), ref: 00F1D481
                                                        • FindClose.KERNEL32(00000000), ref: 00F1D498
                                                        • FindClose.KERNEL32(00000000), ref: 00F1D4A1
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
                                                        • String ID: \*.*
                                                        • API String ID: 2649000838-1173974218
                                                        • Opcode ID: 7bb7ab2835b6946154b17e5efb21a4812fe05ad7d577873bf09098cb50fe414b
                                                        • Instruction ID: a0e37692245ab0d18f31c58bc2e3d72200789b6805ddf23c79758c4075bf3ba5
                                                        • Opcode Fuzzy Hash: 7bb7ab2835b6946154b17e5efb21a4812fe05ad7d577873bf09098cb50fe414b
                                                        • Instruction Fuzzy Hash: 1A31A231009345ABC305EF64D8918EF77F8AE92314F445A2DF4D1A3191EB30AA09E7A3
                                                        Function 00EEE4FF Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: __floor_pentium4
                                                        • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                                        • API String ID: 4168288129-2761157908
                                                        • Opcode ID: 0ae8edfe1b0ea5ec64c312b03119810073c2ca8112a37b2a8a839635fd3c647a
                                                        • Instruction ID: 5a9ecf6c83af2fed4aeba68c788452e8d12b3650151ebc3509e57aec80973601
                                                        • Opcode Fuzzy Hash: 0ae8edfe1b0ea5ec64c312b03119810073c2ca8112a37b2a8a839635fd3c647a
                                                        • Instruction Fuzzy Hash: 34C24872E0866D8FDB25CE299D407EAB7B5EB48305F1451EAD80DF7281E774AE818F40
                                                        Function 00F2648E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • _wcslen.LIBCMT ref: 00F264DC
                                                        • CoInitialize.OLE32(00000000), ref: 00F26639
                                                        • CoCreateInstance.OLE32(00F4FCF8,00000000,00000001,00F4FB68,?), ref: 00F26650
                                                        • CoUninitialize.OLE32 ref: 00F268D4
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: CreateInitializeInstanceUninitialize_wcslen
                                                        • String ID: .lnk
                                                        • API String ID: 886957087-24824748
                                                        • Opcode ID: 005fc4e65900c934daa0e52aaf9189dd0a20dcc663044625fd00700d223a2973
                                                        • Instruction ID: fe184f3b603aa8b027b14935475caab87dcbc5277214104027d358e51f10e676
                                                        • Opcode Fuzzy Hash: 005fc4e65900c934daa0e52aaf9189dd0a20dcc663044625fd00700d223a2973
                                                        • Instruction Fuzzy Hash: 92D14A71608211AFC304EF24C8919ABB7E8FF98704F14596DF595DB292EB70ED05CB92
                                                        Function 00F322DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetForegroundWindow.USER32(?,?,00000000), ref: 00F322E8
                                                          • Part of subcall function 00F2E4EC: GetWindowRect.USER32(?,?), ref: 00F2E504
                                                        • GetDesktopWindow.USER32 ref: 00F32312
                                                        • GetWindowRect.USER32(00000000), ref: 00F32319
                                                        • mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 00F32355
                                                        • GetCursorPos.USER32(?), ref: 00F32381
                                                        • mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00F323DF
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Window$Rectmouse_event$CursorDesktopForeground
                                                        • String ID:
                                                        • API String ID: 2387181109-0
                                                        • Opcode ID: 2bec2d7f1b752760a79794ca82b1724a5a1e96074295c540c3c2a8c3e874ab61
                                                        • Instruction ID: 8fcdbc9728c1280f6b37997c4179f5554fb2b53140f2f0909815b5d22d3797b2
                                                        • Opcode Fuzzy Hash: 2bec2d7f1b752760a79794ca82b1724a5a1e96074295c540c3c2a8c3e874ab61
                                                        • Instruction Fuzzy Hash: A531DC72505319AFD760DF14DC49B9BBBA9FF89320F000A19F98597181DB34EA08DBD2
                                                        Function 00F29B2B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EB9CB3: _wcslen.LIBCMT ref: 00EB9CBD
                                                        • FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 00F29B78
                                                        • FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 00F29C8B
                                                          • Part of subcall function 00F23874: GetInputState.USER32 ref: 00F238CB
                                                          • Part of subcall function 00F23874: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00F23966
                                                        • Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 00F29BA8
                                                        • FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00F29C75
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
                                                        • String ID: *.*
                                                        • API String ID: 1972594611-438819550
                                                        • Opcode ID: e0bd1f1ee7469268cc812832fe901145d3b01f0764cedff996c7a3b18df72de2
                                                        • Instruction ID: b2a976fd341aae48260fce86e9fc7fdc20766d504d1dfab457ac05d569f25c97
                                                        • Opcode Fuzzy Hash: e0bd1f1ee7469268cc812832fe901145d3b01f0764cedff996c7a3b18df72de2
                                                        • Instruction Fuzzy Hash: F8418C71D4421AABCF15DF64D885AEEBBF8EF45310F20406AE815A3191EB709E84DFA1
                                                        Function 00EC997D Relevance: 7.9, APIs: 5, Instructions: 375COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EC9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00EC9BB2
                                                        • DefDlgProcW.USER32(?,?,?,?,?), ref: 00EC9A4E
                                                        • GetSysColor.USER32(0000000F), ref: 00EC9B23
                                                        • SetBkColor.GDI32(?,00000000), ref: 00EC9B36
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Color$LongProcWindow
                                                        • String ID:
                                                        • API String ID: 3131106179-0
                                                        • Opcode ID: e24998711d3a28e8453980d5433aeef3384d4c5fcbd134f5a04fc0f9c55ab9da
                                                        • Instruction ID: 84baa03bbd316e4e8f67d9e636d9a25f4bd8a453a0daccc3b0e4ff962e6c74b3
                                                        • Opcode Fuzzy Hash: e24998711d3a28e8453980d5433aeef3384d4c5fcbd134f5a04fc0f9c55ab9da
                                                        • Instruction Fuzzy Hash: 03A10871A08544BEE724AA2C8E4DFFB3A9DEB42354B14524DF402E65D3CA27AD03F275
                                                        Function 00F31806 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00F3304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00F3307A
                                                          • Part of subcall function 00F3304E: _wcslen.LIBCMT ref: 00F3309B
                                                        • socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 00F3185D
                                                        • WSAGetLastError.WSOCK32 ref: 00F31884
                                                        • bind.WSOCK32(00000000,?,00000010), ref: 00F318DB
                                                        • WSAGetLastError.WSOCK32 ref: 00F318E6
                                                        • closesocket.WSOCK32(00000000), ref: 00F31915
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
                                                        • String ID:
                                                        • API String ID: 1601658205-0
                                                        • Opcode ID: 2e38e69a6c4e00c0a51f13dea934110322d541b23f90adc90e4d8bac091985f7
                                                        • Instruction ID: bacee665dfd3c8b65fbe53ec44fe5bb494103f948069c07142d04bff0ca297db
                                                        • Opcode Fuzzy Hash: 2e38e69a6c4e00c0a51f13dea934110322d541b23f90adc90e4d8bac091985f7
                                                        • Instruction Fuzzy Hash: 1951C375A00200AFEB10AF24C886F6A77E5AB45728F18909CF9166F3D3C775AD41CBE1
                                                        Function 00F41C41 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Window$EnabledForegroundIconicVisibleZoomed
                                                        • String ID:
                                                        • API String ID: 292994002-0
                                                        • Opcode ID: 138e95f308ea721e35c197db0cd767abfd5aab8bda09c58ddba91eff57d05ad4
                                                        • Instruction ID: fba61ca38a1c11ddf3b43279c3243b7a7c8bc82a469a1663c1c9286d6656d1e6
                                                        • Opcode Fuzzy Hash: 138e95f308ea721e35c197db0cd767abfd5aab8bda09c58ddba91eff57d05ad4
                                                        • Instruction Fuzzy Hash: A721B131B412115FE7208F1ADC84BAA7FE5FF95325B199068EC4A8B251DB71DC82EBD0
                                                        Function 00EB8060 Relevance: 7.4, Strings: 5, Instructions: 1151COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: ERCP$VUUU$VUUU$VUUU$VUUU
                                                        • API String ID: 0-1546025612
                                                        • Opcode ID: d70b5111488492b230e62e3efb047ce7e77de667dd50440c043a248e15f8798b
                                                        • Instruction ID: 167d2879e63e90eff62773470a5cc7dbc5c5cede22f67238ea79f620c30070c2
                                                        • Opcode Fuzzy Hash: d70b5111488492b230e62e3efb047ce7e77de667dd50440c043a248e15f8798b
                                                        • Instruction Fuzzy Hash: 5CA26C71A0021ACBDF24CF58C9507FEB7B5BB54318F2491AAEA15B7385EB709D81CB90
                                                        Function 00F1AA57 Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 00F1AAAC
                                                        • SetKeyboardState.USER32(00000080), ref: 00F1AAC8
                                                        • PostMessageW.USER32(?,00000102,00000001,00000001), ref: 00F1AB36
                                                        • SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 00F1AB88
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: KeyboardState$InputMessagePostSend
                                                        • String ID:
                                                        • API String ID: 432972143-0
                                                        • Opcode ID: 7ac8677f9ebf1ed2397c66a286ef0efb7103fd9d43ed59e9cd04a98c4b188b24
                                                        • Instruction ID: a887edfac73fccee3065148696099c04aee85faffc43b4abe56e37f6f4cc8fa4
                                                        • Opcode Fuzzy Hash: 7ac8677f9ebf1ed2397c66a286ef0efb7103fd9d43ed59e9cd04a98c4b188b24
                                                        • Instruction Fuzzy Hash: A0316C70E46688AEFF31CB65CC05BFA77A6AF94320F04421AF481521D1D37589C0E7A2
                                                        Function 00EEBB6F Relevance: 6.1, APIs: 4, Instructions: 90timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • _free.LIBCMT ref: 00EEBB7F
                                                          • Part of subcall function 00EE29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00EED7D1,00000000,00000000,00000000,00000000,?,00EED7F8,00000000,00000007,00000000,?,00EEDBF5,00000000), ref: 00EE29DE
                                                          • Part of subcall function 00EE29C8: GetLastError.KERNEL32(00000000,?,00EED7D1,00000000,00000000,00000000,00000000,?,00EED7F8,00000000,00000007,00000000,?,00EEDBF5,00000000,00000000), ref: 00EE29F0
                                                        • GetTimeZoneInformation.KERNEL32 ref: 00EEBB91
                                                        • WideCharToMultiByte.KERNEL32(00000000,?,00F8121C,000000FF,?,0000003F,?,?), ref: 00EEBC09
                                                        • WideCharToMultiByte.KERNEL32(00000000,?,00F81270,000000FF,?,0000003F,?,?,?,00F8121C,000000FF,?,0000003F,?,?), ref: 00EEBC36
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: ByteCharMultiWide$ErrorFreeHeapInformationLastTimeZone_free
                                                        • String ID:
                                                        • API String ID: 806657224-0
                                                        • Opcode ID: b5e0ae6f1d59954eb1992d7e204a9c174aaf8f9bb14b85eed9ac494d1d932665
                                                        • Instruction ID: 252af90296c5cc3efa94304847be68dce5cd534546bdae921e077a90c9c457c3
                                                        • Opcode Fuzzy Hash: b5e0ae6f1d59954eb1992d7e204a9c174aaf8f9bb14b85eed9ac494d1d932665
                                                        • Instruction Fuzzy Hash: C531A37090828DDFCB11DF6ADC818BABBB8FF55310B24525AE050EB2A1D7309D02DB50
                                                        Function 00F2CE44 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • InternetReadFile.WININET(?,?,00000400,?), ref: 00F2CE89
                                                        • GetLastError.KERNEL32(?,00000000), ref: 00F2CEEA
                                                        • SetEvent.KERNEL32(?,?,00000000), ref: 00F2CEFE
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: ErrorEventFileInternetLastRead
                                                        • String ID:
                                                        • API String ID: 234945975-0
                                                        • Opcode ID: 74e1ea37631f42c22ea0ae1e585ff86731129e5174bb826d04ca5f80acc44d04
                                                        • Instruction ID: 4073ae4431e405ae1d8c796110b465c297a8b8e27d3b210b820ea1d1e1681762
                                                        • Opcode Fuzzy Hash: 74e1ea37631f42c22ea0ae1e585ff86731129e5174bb826d04ca5f80acc44d04
                                                        • Instruction Fuzzy Hash: EF21C171900B159BD720DF65E948BAB77FCEB10368F11441EE546D2151E7B0EE05ABE0
                                                        Function 00F18298 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 568stringCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • lstrlenW.KERNEL32(?,?,?,00000000), ref: 00F182AA
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: lstrlen
                                                        • String ID: ($|
                                                        • API String ID: 1659193697-1631851259
                                                        • Opcode ID: 5a6401506f2c85972c3650d15d9bb81ced991834f572b39673485fed39749acf
                                                        • Instruction ID: 58857b81d41e2998f19b4b6d553a377918f7a878dffa9f1b54e7df02a0c7ee33
                                                        • Opcode Fuzzy Hash: 5a6401506f2c85972c3650d15d9bb81ced991834f572b39673485fed39749acf
                                                        • Instruction Fuzzy Hash: 57323975A007059FC728CF59C580AAAB7F0FF48760B15C56EE49ADB3A1DB70E982DB40
                                                        Function 00F25C97 Relevance: 4.6, APIs: 3, Instructions: 138fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • FindFirstFileW.KERNEL32(?,?), ref: 00F25CC1
                                                        • FindNextFileW.KERNEL32(00000000,?), ref: 00F25D17
                                                        • FindClose.KERNEL32(?), ref: 00F25D5F
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Find$File$CloseFirstNext
                                                        • String ID:
                                                        • API String ID: 3541575487-0
                                                        • Opcode ID: 99532827771a81104312d4a241f700545a729528564b9485adce8290f918c300
                                                        • Instruction ID: 056a380b0581269729fb280ff7d15149ac37c416819634168947af999bd8f167
                                                        • Opcode Fuzzy Hash: 99532827771a81104312d4a241f700545a729528564b9485adce8290f918c300
                                                        • Instruction Fuzzy Hash: DC51B935A08A019FC714CF28D484E9AB7E4FF49324F54855EE99A8B3A2CB30ED05CF91
                                                        Function 00EE2622 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • IsDebuggerPresent.KERNEL32 ref: 00EE271A
                                                        • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00EE2724
                                                        • UnhandledExceptionFilter.KERNEL32(?), ref: 00EE2731
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: ExceptionFilterUnhandled$DebuggerPresent
                                                        • String ID:
                                                        • API String ID: 3906539128-0
                                                        • Opcode ID: 3208a6be9a47bd75dd06fea4c4ebde0d83d00b4b88afbd1c86f82682a9c4cf9f
                                                        • Instruction ID: 57a8da56ba820755d681dcc6fe2637823580b2e594a3d403f8fcb9f2b8e8a05c
                                                        • Opcode Fuzzy Hash: 3208a6be9a47bd75dd06fea4c4ebde0d83d00b4b88afbd1c86f82682a9c4cf9f
                                                        • Instruction Fuzzy Hash: 3331C27490121CABCB21DF68DD8879CBBB8EF18710F5051EAE91CA6260E7709F818F85
                                                        Function 00F251CD Relevance: 4.6, APIs: 3, Instructions: 76COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SetErrorMode.KERNEL32(00000001), ref: 00F251DA
                                                        • GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00F25238
                                                        • SetErrorMode.KERNEL32(00000000), ref: 00F252A1
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: ErrorMode$DiskFreeSpace
                                                        • String ID:
                                                        • API String ID: 1682464887-0
                                                        • Opcode ID: f7345075c2dc78e9312c1ef381561ff23c9f8b67fbb4056367c2425311c1d637
                                                        • Instruction ID: c560dee5bb828bdb988144940abbec80cc28f7e3ff5fec29ee04cac1359f75cc
                                                        • Opcode Fuzzy Hash: f7345075c2dc78e9312c1ef381561ff23c9f8b67fbb4056367c2425311c1d637
                                                        • Instruction Fuzzy Hash: F3314C75A00518DFDB00DF54D884EAEBBF4FF49318F188099E805AB3A2DB31E856CB91
                                                        Function 00F116C3 Relevance: 4.6, APIs: 3, Instructions: 68COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00ECFDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00ED0668
                                                          • Part of subcall function 00ECFDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00ED0685
                                                        • LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00F1170D
                                                        • AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00F1173A
                                                        • GetLastError.KERNEL32 ref: 00F1174A
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
                                                        • String ID:
                                                        • API String ID: 577356006-0
                                                        • Opcode ID: 1312d4934e6c24c2fce86fccb657071ed4caad3b3685ec30579a7aa6aab86fdc
                                                        • Instruction ID: adac8d3fcbee94db28e2f1581db9eade1e39cef7e4090510a7f8d05d78f489fe
                                                        • Opcode Fuzzy Hash: 1312d4934e6c24c2fce86fccb657071ed4caad3b3685ec30579a7aa6aab86fdc
                                                        • Instruction Fuzzy Hash: 8D11C1B2400308AFD7189F54DC86EAABBF9FB04714B20852EE45693291EB71BC818A60
                                                        Function 00F1D5EB Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00F1D608
                                                        • DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 00F1D645
                                                        • CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00F1D650
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: CloseControlCreateDeviceFileHandle
                                                        • String ID:
                                                        • API String ID: 33631002-0
                                                        • Opcode ID: a257fb03c25f0792011bbf6871ea63c81d1df58a85fa631f018028538156c461
                                                        • Instruction ID: dfe02e16478747253ac4ad24af8a70d1aa1087fd35586e32dd4ff37e1a9811e6
                                                        • Opcode Fuzzy Hash: a257fb03c25f0792011bbf6871ea63c81d1df58a85fa631f018028538156c461
                                                        • Instruction Fuzzy Hash: F7113C75E05228BBDB208F959C45FAFBBBCEB45B60F108115F904E7290D6B05A059BA1
                                                        Function 00F11663 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00F1168C
                                                        • CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00F116A1
                                                        • FreeSid.ADVAPI32(?), ref: 00F116B1
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: AllocateCheckFreeInitializeMembershipToken
                                                        • String ID:
                                                        • API String ID: 3429775523-0
                                                        • Opcode ID: d4fd05275fd035582676eea0d0fa8a8746ad0f1ede072b56ddf31f6b14dde89c
                                                        • Instruction ID: ff92123127a73b8219b0458e676b95d47b4fd6755ee3436c35cea00c2a585af3
                                                        • Opcode Fuzzy Hash: d4fd05275fd035582676eea0d0fa8a8746ad0f1ede072b56ddf31f6b14dde89c
                                                        • Instruction Fuzzy Hash: 14F04475A4130CFBEB00CFE48C89AAEBBBCFB08200F004860E900E2180E330AA449A90
                                                        Function 00F0D27A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetUserNameW.ADVAPI32(?,?), ref: 00F0D28C
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: NameUser
                                                        • String ID: X64
                                                        • API String ID: 2645101109-893830106
                                                        • Opcode ID: 8a706655e84a32008e5bcbc48ea191d7b7be1c64ce230426447ce4a9c1fa6a2d
                                                        • Instruction ID: e9882484c0c0837f064218a69c128370a75839fbb7d84e9c92c538ba98867499
                                                        • Opcode Fuzzy Hash: 8a706655e84a32008e5bcbc48ea191d7b7be1c64ce230426447ce4a9c1fa6a2d
                                                        • Instruction Fuzzy Hash: 57D0C9B580611DEBCB94CB94DC88ED9B37CBB14305F100155F506E2140D7309549AF10
                                                        Function 00EDCAA0 Relevance: 3.5, APIs: 2, Instructions: 464COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
                                                        • Instruction ID: 1266ba10e2e0ee47b0977fda63bfc75975b2d950751ca67c346e06a8d7238f4e
                                                        • Opcode Fuzzy Hash: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
                                                        • Instruction Fuzzy Hash: 29021C71E0011A9BDF14CFA9C9806ADFBF1EF48354F25926AD919F7380D731AA42CB90
                                                        Function 00F268EE Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • FindFirstFileW.KERNEL32(?,?), ref: 00F26918
                                                        • FindClose.KERNEL32(00000000), ref: 00F26961
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Find$CloseFileFirst
                                                        • String ID:
                                                        • API String ID: 2295610775-0
                                                        • Opcode ID: 9dfe2098c7151cbab7fcdb31acd302c9ecfe3c9f91190068d105343c9adcc002
                                                        • Instruction ID: c9f8f75e4eb3da895f7f508dd1fb4ddbe4368e5f3961388e23a31d4edf7e4e28
                                                        • Opcode Fuzzy Hash: 9dfe2098c7151cbab7fcdb31acd302c9ecfe3c9f91190068d105343c9adcc002
                                                        • Instruction Fuzzy Hash: 8D11D0356042109FC710CF29D484A26BBE1FF85328F14C6A9F8698F6A2CB70EC45CBD0
                                                        Function 00F237B5 Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,00F34891,?,?,00000035,?), ref: 00F237E4
                                                        • FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,00F34891,?,?,00000035,?), ref: 00F237F4
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: ErrorFormatLastMessage
                                                        • String ID:
                                                        • API String ID: 3479602957-0
                                                        • Opcode ID: 8b5ffd249849e33a92396b861e1a1143de19da4f70dcf395da445983b5e6c418
                                                        • Instruction ID: 2a9571b7ddbea950850a44229d387114520e9aa0fc30683a1be571f1b42530fd
                                                        • Opcode Fuzzy Hash: 8b5ffd249849e33a92396b861e1a1143de19da4f70dcf395da445983b5e6c418
                                                        • Instruction Fuzzy Hash: D0F055B170522C2BEB2017A69C4CFEB3AAEEFC5760F000261F608E2281C9A08900C6F0
                                                        Function 00F1B226 Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 00F1B25D
                                                        • keybd_event.USER32(?,75C0C0D0,?,00000000), ref: 00F1B270
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: InputSendkeybd_event
                                                        • String ID:
                                                        • API String ID: 3536248340-0
                                                        • Opcode ID: da9f8e330e1b6e674bfc8d8b4923aa8f17a0bc773991deda063fdfbbb83df003
                                                        • Instruction ID: 91f7bdb23f1cb344bf22c36e43cce85fb653408c868bf55a8fbbe355ccf317e8
                                                        • Opcode Fuzzy Hash: da9f8e330e1b6e674bfc8d8b4923aa8f17a0bc773991deda063fdfbbb83df003
                                                        • Instruction Fuzzy Hash: B7F06D7580428DABDB058FA0C805BEE7BB0FF05305F008009F951A5191C3798205AF94
                                                        Function 00F110BF Relevance: 3.0, APIs: 2, Instructions: 24COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00F111FC), ref: 00F110D4
                                                        • CloseHandle.KERNEL32(?,?,00F111FC), ref: 00F110E9
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: AdjustCloseHandlePrivilegesToken
                                                        • String ID:
                                                        • API String ID: 81990902-0
                                                        • Opcode ID: 270f46b1f99682cbfa15a9cddfd4e3dd7cc911b6ceec86b1f973773e5c131573
                                                        • Instruction ID: f1ba5a9686624311ffe7eb9e99f69078cc93e06584431c0a48fb16cdb342dcc2
                                                        • Opcode Fuzzy Hash: 270f46b1f99682cbfa15a9cddfd4e3dd7cc911b6ceec86b1f973773e5c131573
                                                        • Instruction Fuzzy Hash: 25E04F32005610AEF7252B11FC05F737BE9EB04320B10882DF9A6804B1DB726C90EB50
                                                        Function 00EBCAF0 Relevance: 1.9, Strings: 1, Instructions: 659COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        • Variable is not of type 'Object'., xrefs: 00F00C40
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: Variable is not of type 'Object'.
                                                        • API String ID: 0-1840281001
                                                        • Opcode ID: ee0ae7469be194f2d64fc810d2990ff301023776c9829daa8452f1464a5a9c6f
                                                        • Instruction ID: a32246c7c761ef1059cc043bef4ee31f8fd9815b350fec918bc64a43b7e3c891
                                                        • Opcode Fuzzy Hash: ee0ae7469be194f2d64fc810d2990ff301023776c9829daa8452f1464a5a9c6f
                                                        • Instruction Fuzzy Hash: 8F328D74A04218DBCF14DF90C981BFEB7B5BF04318F245069E806BB292DB75AD45EB61
                                                        Function 00EE676B Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00EE6766,?,?,00000008,?,?,00EEFEFE,00000000), ref: 00EE6998
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: ExceptionRaise
                                                        • String ID:
                                                        • API String ID: 3997070919-0
                                                        • Opcode ID: ff3a1c1b0cf0a4f4ddeeaf152ec8bf9e326e87be0e7a40ce2a50e0ca5292f895
                                                        • Instruction ID: 24185731bde3e08d8d109df6619298c7774bc88aab78016d43e19a30c0012b63
                                                        • Opcode Fuzzy Hash: ff3a1c1b0cf0a4f4ddeeaf152ec8bf9e326e87be0e7a40ce2a50e0ca5292f895
                                                        • Instruction Fuzzy Hash: BFB17D31610648CFD719CF29C486BA47BE0FF553A8F259658E8D9DF2A2C336E981CB40
                                                        Function 00ECB119 Relevance: 1.8, Strings: 1, Instructions: 511COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID: 0-3916222277
                                                        • Opcode ID: 186d0315dc6c24d4a2ac56cbc6fb2fe889ae045253168a1ce912110dce6fae01
                                                        • Instruction ID: 65aefbced6b0db8e981f801400dcfc17f775a0e1c8f8c4f4cbc8a06b24647919
                                                        • Opcode Fuzzy Hash: 186d0315dc6c24d4a2ac56cbc6fb2fe889ae045253168a1ce912110dce6fae01
                                                        • Instruction Fuzzy Hash: C8126275D002299BCB14CF58C941BEEB7F5FF48710F14819AE849EB291EB359E42DB90
                                                        Function 00F2EAA2 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • BlockInput.USER32(00000001), ref: 00F2EABD
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: BlockInput
                                                        • String ID:
                                                        • API String ID: 3456056419-0
                                                        • Opcode ID: 713bb8ecac047cdaf66fbdd133cf32aa9a3a43ae2a6fd5dd2fa76ad8b96241fb
                                                        • Instruction ID: fa83d3b1a062c2ee75815c7d85501856e3bd79d7d8a8e611c74957e64606c665
                                                        • Opcode Fuzzy Hash: 713bb8ecac047cdaf66fbdd133cf32aa9a3a43ae2a6fd5dd2fa76ad8b96241fb
                                                        • Instruction Fuzzy Hash: 7FE01A362012149FC710EF59E814E9AB7EDAFA9760F10941AFC4AD7251DAB4A8409B91
                                                        Function 00ED09D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SetUnhandledExceptionFilter.KERNEL32(Function_000209E1,00ED03EE), ref: 00ED09DA
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: ExceptionFilterUnhandled
                                                        • String ID:
                                                        • API String ID: 3192549508-0
                                                        • Opcode ID: f990b3b235f220bbfe2b599d673d0f486e399bd29f9fbae0bea5e78ed981262a
                                                        • Instruction ID: a5517c89966c8cd0e6e73f58ddd9d90661985fe91b2a162a751f6e3830487c2f
                                                        • Opcode Fuzzy Hash: f990b3b235f220bbfe2b599d673d0f486e399bd29f9fbae0bea5e78ed981262a
                                                        • Instruction Fuzzy Hash:
                                                        Function 00ED781B Relevance: 1.5, Strings: 1, Instructions: 214COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: 0
                                                        • API String ID: 0-4108050209
                                                        • Opcode ID: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
                                                        • Instruction ID: 2ed23d75cba27237489c157db71c882bc3eb9deaa6e6480b535f570514d14d78
                                                        • Opcode Fuzzy Hash: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
                                                        • Instruction Fuzzy Hash: 2351337660C6655ADB3C4728896A7BE63D5DB82308F18350BD8C6FB382F611DE43E352
                                                        Function 00EE6DD9 Relevance: .6, Instructions: 637COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: fdd08e226f1392fdbf78ab07171cfd93c6cff11d8659402f89c6edd091971a56
                                                        • Instruction ID: 8c3770de671fabf4e3581d6fef2edef6284570955bfaa25c9db47a57bb680b44
                                                        • Opcode Fuzzy Hash: fdd08e226f1392fdbf78ab07171cfd93c6cff11d8659402f89c6edd091971a56
                                                        • Instruction Fuzzy Hash: FC326722D28F894ED7239635DC223357249AFB73C6F14E337F85AB59A9EB28C4835100
                                                        Function 00ECCC39 Relevance: .6, Instructions: 635COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 1021b84dc371406f5e2fb7cb1bbf27614bcfda07ba1e5b2a2eb9434c6ea4de27
                                                        • Instruction ID: 54dbf14d947dc6dc7d24a8db9a663f1ca99d86161a91561ecb8c0fc7b1bbde48
                                                        • Opcode Fuzzy Hash: 1021b84dc371406f5e2fb7cb1bbf27614bcfda07ba1e5b2a2eb9434c6ea4de27
                                                        • Instruction Fuzzy Hash: C532F532E001558BDF28CB28C594B7DB7A1EB45324F38866AD85EDB2D1D235DD82FB81
                                                        Function 00EB7920 Relevance: .6, Instructions: 563COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 66d48583c0fc06a9f4d7a2f3a111d88904e4bfa36ef2844518a5aa473f07196c
                                                        • Instruction ID: d52eab1442e50f4aaffc3a332ce168ac74dae579eb3223d3391c3c8857658aaf
                                                        • Opcode Fuzzy Hash: 66d48583c0fc06a9f4d7a2f3a111d88904e4bfa36ef2844518a5aa473f07196c
                                                        • Instruction Fuzzy Hash: 5322DF71A0060A9FDF14CF64C981AEEB3F2FF54304F206229E956B7291EB369D01CB50
                                                        Function 00EB91C0 Relevance: .5, Instructions: 475COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 3038cb5b2f79fc7832d01c5475aeebf144db9de9ac5e6ad1c7f3cd5e8478ca11
                                                        • Instruction ID: d7eb67e04cc97aa3574d4782f14b3bcec567e1967c8e684146e2569f62006339
                                                        • Opcode Fuzzy Hash: 3038cb5b2f79fc7832d01c5475aeebf144db9de9ac5e6ad1c7f3cd5e8478ca11
                                                        • Instruction Fuzzy Hash: 7202A4B0E00209EBDB14DF64D981BEEB7F1FF44304F109169E916AB3A1E731AA51DB91
                                                        Function 00EE9EEE Relevance: .3, Instructions: 294COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 043c7e64d9cfed992fe06aa4519cc1ab551ed154f63e234a15474a72f3546944
                                                        • Instruction ID: 65bd4c31f63e16bcf47375ef73965702a29cafb3e19250d5338419c1105ef845
                                                        • Opcode Fuzzy Hash: 043c7e64d9cfed992fe06aa4519cc1ab551ed154f63e234a15474a72f3546944
                                                        • Instruction Fuzzy Hash: B0B1F220D2AF444DD32396398831336B75CAFBB6D6F92D71BFD2674D22EB2286835140
                                                        Function 00ED1C77 Relevance: .3, Instructions: 254COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
                                                        • Instruction ID: 716b6b029dfa54c1f52a3d0e188b0c090945f71c8941f5954be606323d692efd
                                                        • Opcode Fuzzy Hash: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
                                                        • Instruction Fuzzy Hash: 589178722080E359DB2D4639857407DFFE1DA923A631A17DFD8F2DA2C5EE208555D620
                                                        Function 00ED1F32 Relevance: .2, Instructions: 244COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
                                                        • Instruction ID: 21f6c5b1946bdcbc5867cfe1882e36a0fb8645c8b321e6aaf120cb9a7c2ccd59
                                                        • Opcode Fuzzy Hash: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
                                                        • Instruction Fuzzy Hash: A79198722090A34DDB294239843407DFFE1DAA23A530A57DFD5F2EB2C5EE24C956D620
                                                        Function 00ED19B0 Relevance: .2, Instructions: 240COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
                                                        • Instruction ID: baefe50b8d892bd4e4d0fcc109cb7638354286799db8e876387e3347352738e8
                                                        • Opcode Fuzzy Hash: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
                                                        • Instruction Fuzzy Hash: CC91A37220D0A35EDB2D427A857407DFFE1CA923A531A27DFD4F2EA2C1FD248556D620
                                                        Function 00ED7A4A Relevance: .2, Instructions: 237COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 6a2055e0735b30b36c316c6030662274ded90993f2f8e594a060de1663d4d253
                                                        • Instruction ID: a6b0966e023057a1b3e8e18a595cf3418c802d3821e273b9188f418525451712
                                                        • Opcode Fuzzy Hash: 6a2055e0735b30b36c316c6030662274ded90993f2f8e594a060de1663d4d253
                                                        • Instruction Fuzzy Hash: 6061367120870996DA349B2889A6BFE63D6DF41708F14391BE8C2FB3C1FA119E438355
                                                        Function 00ED7CA7 Relevance: .2, Instructions: 237COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 277fb2560990b1f4fe70d222b5b009fb7893780cf8538928cf80fa614de4e6ce
                                                        • Instruction ID: 3aaa3b12f9f76fd6491f4e52bce5655323b917e3db7d9d70661538196d5c8682
                                                        • Opcode Fuzzy Hash: 277fb2560990b1f4fe70d222b5b009fb7893780cf8538928cf80fa614de4e6ce
                                                        • Instruction Fuzzy Hash: A761367160870956DA384B288956BBE6396DF4370CF10395FEDC2FB381FA12ED438255
                                                        Function 00ED1706 Relevance: .2, Instructions: 232COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
                                                        • Instruction ID: 962d8eb0b000f7827c2044fa92000d78f58a2c35d4c3a3adbf2226ecb84d5086
                                                        • Opcode Fuzzy Hash: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
                                                        • Instruction Fuzzy Hash: EF8195766080E31DDB2D823A853407EFFE1DA923A531A17DFD4F2DA2D1EE248555E620
                                                        Function 00F22046 Relevance: .1, Instructions: 72COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: aa3e948f322d931540f4ecb66456d2773f8fa7fe3499480804a49b0671af4e32
                                                        • Instruction ID: 0cf6582c9e7a8bb9c4dc491f367336f3c2c5f1706d1c8f77b50fcfede6dbe7fb
                                                        • Opcode Fuzzy Hash: aa3e948f322d931540f4ecb66456d2773f8fa7fe3499480804a49b0671af4e32
                                                        • Instruction Fuzzy Hash: EC21E7327206158BD768CF79C8236BE73E5A754320F14862EE4A7C73D0DE39A904DB80
                                                        Function 00F32ADE Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • DeleteObject.GDI32(00000000), ref: 00F32B30
                                                        • DeleteObject.GDI32(00000000), ref: 00F32B43
                                                        • DestroyWindow.USER32 ref: 00F32B52
                                                        • GetDesktopWindow.USER32 ref: 00F32B6D
                                                        • GetWindowRect.USER32(00000000), ref: 00F32B74
                                                        • SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 00F32CA3
                                                        • AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00F32CB1
                                                        • CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00F32CF8
                                                        • GetClientRect.USER32(00000000,?), ref: 00F32D04
                                                        • CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00F32D40
                                                        • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00F32D62
                                                        • GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00F32D75
                                                        • GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00F32D80
                                                        • GlobalLock.KERNEL32(00000000), ref: 00F32D89
                                                        • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00F32D98
                                                        • GlobalUnlock.KERNEL32(00000000), ref: 00F32DA1
                                                        • CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00F32DA8
                                                        • GlobalFree.KERNEL32(00000000), ref: 00F32DB3
                                                        • CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00F32DC5
                                                        • OleLoadPicture.OLEAUT32(?,00000000,00000000,00F4FC38,00000000), ref: 00F32DDB
                                                        • GlobalFree.KERNEL32(00000000), ref: 00F32DEB
                                                        • CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 00F32E11
                                                        • SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 00F32E30
                                                        • SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00F32E52
                                                        • ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00F3303F
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
                                                        • String ID: $AutoIt v3$DISPLAY$static
                                                        • API String ID: 2211948467-2373415609
                                                        • Opcode ID: ce4a5141b685f827c0d059bdffed178e2510216c87530a361e346e485698d1b4
                                                        • Instruction ID: 74885164e267f46c29338149a10551177fae54ffbf494ff28c63ec0615b9213b
                                                        • Opcode Fuzzy Hash: ce4a5141b685f827c0d059bdffed178e2510216c87530a361e346e485698d1b4
                                                        • Instruction Fuzzy Hash: 37027075A01208AFDB54DFA4CC89EAE7BB9FF49320F049118F915AB2A1C774DD01DBA0
                                                        Function 00F470D5 Relevance: 49.8, APIs: 33, Instructions: 273COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SetTextColor.GDI32(?,00000000), ref: 00F4712F
                                                        • GetSysColorBrush.USER32(0000000F), ref: 00F47160
                                                        • GetSysColor.USER32(0000000F), ref: 00F4716C
                                                        • SetBkColor.GDI32(?,000000FF), ref: 00F47186
                                                        • SelectObject.GDI32(?,?), ref: 00F47195
                                                        • InflateRect.USER32(?,000000FF,000000FF), ref: 00F471C0
                                                        • GetSysColor.USER32(00000010), ref: 00F471C8
                                                        • CreateSolidBrush.GDI32(00000000), ref: 00F471CF
                                                        • FrameRect.USER32(?,?,00000000), ref: 00F471DE
                                                        • DeleteObject.GDI32(00000000), ref: 00F471E5
                                                        • InflateRect.USER32(?,000000FE,000000FE), ref: 00F47230
                                                        • FillRect.USER32(?,?,?), ref: 00F47262
                                                        • GetWindowLongW.USER32(?,000000F0), ref: 00F47284
                                                          • Part of subcall function 00F473E8: GetSysColor.USER32(00000012), ref: 00F47421
                                                          • Part of subcall function 00F473E8: SetTextColor.GDI32(?,?), ref: 00F47425
                                                          • Part of subcall function 00F473E8: GetSysColorBrush.USER32(0000000F), ref: 00F4743B
                                                          • Part of subcall function 00F473E8: GetSysColor.USER32(0000000F), ref: 00F47446
                                                          • Part of subcall function 00F473E8: GetSysColor.USER32(00000011), ref: 00F47463
                                                          • Part of subcall function 00F473E8: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00F47471
                                                          • Part of subcall function 00F473E8: SelectObject.GDI32(?,00000000), ref: 00F47482
                                                          • Part of subcall function 00F473E8: SetBkColor.GDI32(?,00000000), ref: 00F4748B
                                                          • Part of subcall function 00F473E8: SelectObject.GDI32(?,?), ref: 00F47498
                                                          • Part of subcall function 00F473E8: InflateRect.USER32(?,000000FF,000000FF), ref: 00F474B7
                                                          • Part of subcall function 00F473E8: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00F474CE
                                                          • Part of subcall function 00F473E8: GetWindowLongW.USER32(00000000,000000F0), ref: 00F474DB
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
                                                        • String ID:
                                                        • API String ID: 4124339563-0
                                                        • Opcode ID: 9f29ad93d710768e2b3ffc029aeb341aeb003ccf7def39e15cec80d4ec4d3749
                                                        • Instruction ID: 4f65bdd3b6a9c28f4b4f69d92065a8da3a01c4e4508725ee36f2222eac972c1d
                                                        • Opcode Fuzzy Hash: 9f29ad93d710768e2b3ffc029aeb341aeb003ccf7def39e15cec80d4ec4d3749
                                                        • Instruction Fuzzy Hash: 34A1D136409305AFD750AF60CC48E6B7BA9FF8A320F141A19FD62A61E1D774E940EF91
                                                        Function 00EC8D85 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 480windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • DestroyWindow.USER32(?,?), ref: 00EC8E14
                                                        • SendMessageW.USER32(?,00001308,?,00000000), ref: 00F06AC5
                                                        • ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00F06AFE
                                                        • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00F06F43
                                                          • Part of subcall function 00EC8F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00EC8BE8,?,00000000,?,?,?,?,00EC8BBA,00000000,?), ref: 00EC8FC5
                                                        • SendMessageW.USER32(?,00001053), ref: 00F06F7F
                                                        • SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00F06F96
                                                        • ImageList_Destroy.COMCTL32(00000000,?), ref: 00F06FAC
                                                        • ImageList_Destroy.COMCTL32(00000000,?), ref: 00F06FB7
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: DestroyImageList_MessageSend$Window$InvalidateMoveRectRemove
                                                        • String ID: 0
                                                        • API String ID: 2760611726-4108050209
                                                        • Opcode ID: 1184c8b1ad115e15d5cf21f642131f4cfd58af4109dffc8572f89c239429cc05
                                                        • Instruction ID: af233a2c06e51ba8a69f0dc49c2a319da26de3ac745a2517eccddc4ba44de689
                                                        • Opcode Fuzzy Hash: 1184c8b1ad115e15d5cf21f642131f4cfd58af4109dffc8572f89c239429cc05
                                                        • Instruction Fuzzy Hash: 7312BC34A01205DFDB25CF14CE44BA9BBE5FB45320F14916DF495DB2A2CB32A862FB91
                                                        Function 00F32711 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • DestroyWindow.USER32(00000000), ref: 00F3273E
                                                        • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00F3286A
                                                        • SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 00F328A9
                                                        • AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 00F328B9
                                                        • CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 00F32900
                                                        • GetClientRect.USER32(00000000,?), ref: 00F3290C
                                                        • CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 00F32955
                                                        • CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00F32964
                                                        • GetStockObject.GDI32(00000011), ref: 00F32974
                                                        • SelectObject.GDI32(00000000,00000000), ref: 00F32978
                                                        • GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 00F32988
                                                        • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00F32991
                                                        • DeleteDC.GDI32(00000000), ref: 00F3299A
                                                        • CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00F329C6
                                                        • SendMessageW.USER32(00000030,00000000,00000001), ref: 00F329DD
                                                        • CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 00F32A1D
                                                        • SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00F32A31
                                                        • SendMessageW.USER32(00000404,00000001,00000000), ref: 00F32A42
                                                        • CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 00F32A77
                                                        • GetStockObject.GDI32(00000011), ref: 00F32A82
                                                        • SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00F32A8D
                                                        • ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 00F32A97
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
                                                        • String ID: AutoIt v3$DISPLAY$msctls_progress32$static
                                                        • API String ID: 2910397461-517079104
                                                        • Opcode ID: 6b460dda8937dcccafb88ecdac5eb5a2ebb1604c32465f8a57ba4314df531866
                                                        • Instruction ID: 1e9cf3c965252f9a8a32d7e026396b01cdc6aa4029351bbb2ec763dafc5fc3aa
                                                        • Opcode Fuzzy Hash: 6b460dda8937dcccafb88ecdac5eb5a2ebb1604c32465f8a57ba4314df531866
                                                        • Instruction Fuzzy Hash: 08B16C75A01209AFEB14DFA8CC49FAE7BA9FB48720F008615F915E7290D774ED40DBA4
                                                        Function 00F24ADF Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SetErrorMode.KERNEL32(00000001), ref: 00F24AED
                                                        • GetDriveTypeW.KERNEL32(?,00F4CB68,?,\\.\,00F4CC08), ref: 00F24BCA
                                                        • SetErrorMode.KERNEL32(00000000,00F4CB68,?,\\.\,00F4CC08), ref: 00F24D36
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: ErrorMode$DriveType
                                                        • String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
                                                        • API String ID: 2907320926-4222207086
                                                        • Opcode ID: cf4d467ff8ec62fcc9bc47c78e40d573c051f6b85eff82e7588030a005a1dd54
                                                        • Instruction ID: 010aa875efd019b04d229fb09aa12f115670c0b9bf616bf19c243bcdb0fe676a
                                                        • Opcode Fuzzy Hash: cf4d467ff8ec62fcc9bc47c78e40d573c051f6b85eff82e7588030a005a1dd54
                                                        • Instruction Fuzzy Hash: 6A61E6316415159BCB15DF28DA81EAD77B0EB44314B248017F80AEB692DBB5FD41FB43
                                                        Function 00F473E8 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetSysColor.USER32(00000012), ref: 00F47421
                                                        • SetTextColor.GDI32(?,?), ref: 00F47425
                                                        • GetSysColorBrush.USER32(0000000F), ref: 00F4743B
                                                        • GetSysColor.USER32(0000000F), ref: 00F47446
                                                        • CreateSolidBrush.GDI32(?), ref: 00F4744B
                                                        • GetSysColor.USER32(00000011), ref: 00F47463
                                                        • CreatePen.GDI32(00000000,00000001,00743C00), ref: 00F47471
                                                        • SelectObject.GDI32(?,00000000), ref: 00F47482
                                                        • SetBkColor.GDI32(?,00000000), ref: 00F4748B
                                                        • SelectObject.GDI32(?,?), ref: 00F47498
                                                        • InflateRect.USER32(?,000000FF,000000FF), ref: 00F474B7
                                                        • RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00F474CE
                                                        • GetWindowLongW.USER32(00000000,000000F0), ref: 00F474DB
                                                        • SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00F4752A
                                                        • GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00F47554
                                                        • InflateRect.USER32(?,000000FD,000000FD), ref: 00F47572
                                                        • DrawFocusRect.USER32(?,?), ref: 00F4757D
                                                        • GetSysColor.USER32(00000011), ref: 00F4758E
                                                        • SetTextColor.GDI32(?,00000000), ref: 00F47596
                                                        • DrawTextW.USER32(?,00F470F5,000000FF,?,00000000), ref: 00F475A8
                                                        • SelectObject.GDI32(?,?), ref: 00F475BF
                                                        • DeleteObject.GDI32(?), ref: 00F475CA
                                                        • SelectObject.GDI32(?,?), ref: 00F475D0
                                                        • DeleteObject.GDI32(?), ref: 00F475D5
                                                        • SetTextColor.GDI32(?,?), ref: 00F475DB
                                                        • SetBkColor.GDI32(?,?), ref: 00F475E5
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
                                                        • String ID:
                                                        • API String ID: 1996641542-0
                                                        • Opcode ID: 2ef6696d2a4af076b09c2095782de4e74a1b53dfc3cb4772b0a83efaddf2b080
                                                        • Instruction ID: 2b79731d1c247b7800b5bdb306dee40e119d5823f117e50117338f55a0dac264
                                                        • Opcode Fuzzy Hash: 2ef6696d2a4af076b09c2095782de4e74a1b53dfc3cb4772b0a83efaddf2b080
                                                        • Instruction Fuzzy Hash: 98618A76D01218AFDB00AFA4DC48EAEBFB9EB09320F155115FD15BB2A1D7749940EF90
                                                        Function 00F40FF3 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetCursorPos.USER32(?), ref: 00F41128
                                                        • GetDesktopWindow.USER32 ref: 00F4113D
                                                        • GetWindowRect.USER32(00000000), ref: 00F41144
                                                        • GetWindowLongW.USER32(?,000000F0), ref: 00F41199
                                                        • DestroyWindow.USER32(?), ref: 00F411B9
                                                        • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00F411ED
                                                        • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00F4120B
                                                        • SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00F4121D
                                                        • SendMessageW.USER32(00000000,00000421,?,?), ref: 00F41232
                                                        • SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 00F41245
                                                        • IsWindowVisible.USER32(00000000), ref: 00F412A1
                                                        • SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 00F412BC
                                                        • SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 00F412D0
                                                        • GetWindowRect.USER32(00000000,?), ref: 00F412E8
                                                        • MonitorFromPoint.USER32(?,?,00000002), ref: 00F4130E
                                                        • GetMonitorInfoW.USER32(00000000,?), ref: 00F41328
                                                        • CopyRect.USER32(?,?), ref: 00F4133F
                                                        • SendMessageW.USER32(00000000,00000412,00000000), ref: 00F413AA
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
                                                        • String ID: ($0$tooltips_class32
                                                        • API String ID: 698492251-4156429822
                                                        • Opcode ID: 6f85d55fe6a301773e83de7372277f49225ad0eaf6bd6006927f7e3c03c5fc6a
                                                        • Instruction ID: d1536fab9c29fab2992ec30c921953495e9848d61f103f33e9ba35cf8b27fca8
                                                        • Opcode Fuzzy Hash: 6f85d55fe6a301773e83de7372277f49225ad0eaf6bd6006927f7e3c03c5fc6a
                                                        • Instruction Fuzzy Hash: 3CB18C71604341AFD754DF64C884BABBFE8FF85350F008918F999AB2A1C771E884DB92
                                                        Function 00EC8891 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00EC8968
                                                        • GetSystemMetrics.USER32(00000007), ref: 00EC8970
                                                        • SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00EC899B
                                                        • GetSystemMetrics.USER32(00000008), ref: 00EC89A3
                                                        • GetSystemMetrics.USER32(00000004), ref: 00EC89C8
                                                        • SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00EC89E5
                                                        • AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00EC89F5
                                                        • CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00EC8A28
                                                        • SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00EC8A3C
                                                        • GetClientRect.USER32(00000000,000000FF), ref: 00EC8A5A
                                                        • GetStockObject.GDI32(00000011), ref: 00EC8A76
                                                        • SendMessageW.USER32(00000000,00000030,00000000), ref: 00EC8A81
                                                          • Part of subcall function 00EC912D: GetCursorPos.USER32(?), ref: 00EC9141
                                                          • Part of subcall function 00EC912D: ScreenToClient.USER32(00000000,?), ref: 00EC915E
                                                          • Part of subcall function 00EC912D: GetAsyncKeyState.USER32(00000001), ref: 00EC9183
                                                          • Part of subcall function 00EC912D: GetAsyncKeyState.USER32(00000002), ref: 00EC919D
                                                        • SetTimer.USER32(00000000,00000000,00000028,00EC90FC), ref: 00EC8AA8
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
                                                        • String ID: AutoIt v3 GUI
                                                        • API String ID: 1458621304-248962490
                                                        • Opcode ID: ed17dc5a03953835f4741b5a0be39f51c573c1ed1212b1b45a154736a143d153
                                                        • Instruction ID: f29789bb93048b337eb841947bff831ca04991d8eb427d74b2e465ce771428eb
                                                        • Opcode Fuzzy Hash: ed17dc5a03953835f4741b5a0be39f51c573c1ed1212b1b45a154736a143d153
                                                        • Instruction Fuzzy Hash: 3FB17B35A00209AFDB14DFA8CE45BEE3BB5FB48314F105229FA15E7290DB35A852EB54
                                                        Function 00F10D8B Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00F110F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00F11114
                                                          • Part of subcall function 00F110F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00F10B9B,?,?,?), ref: 00F11120
                                                          • Part of subcall function 00F110F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00F10B9B,?,?,?), ref: 00F1112F
                                                          • Part of subcall function 00F110F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00F10B9B,?,?,?), ref: 00F11136
                                                          • Part of subcall function 00F110F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00F1114D
                                                        • GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00F10DF5
                                                        • GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00F10E29
                                                        • GetLengthSid.ADVAPI32(?), ref: 00F10E40
                                                        • GetAce.ADVAPI32(?,00000000,?), ref: 00F10E7A
                                                        • AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00F10E96
                                                        • GetLengthSid.ADVAPI32(?), ref: 00F10EAD
                                                        • GetProcessHeap.KERNEL32(00000008,00000008), ref: 00F10EB5
                                                        • HeapAlloc.KERNEL32(00000000), ref: 00F10EBC
                                                        • GetLengthSid.ADVAPI32(?,00000008,?), ref: 00F10EDD
                                                        • CopySid.ADVAPI32(00000000), ref: 00F10EE4
                                                        • AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00F10F13
                                                        • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00F10F35
                                                        • SetUserObjectSecurity.USER32(?,00000004,?), ref: 00F10F47
                                                        • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00F10F6E
                                                        • HeapFree.KERNEL32(00000000), ref: 00F10F75
                                                        • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00F10F7E
                                                        • HeapFree.KERNEL32(00000000), ref: 00F10F85
                                                        • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00F10F8E
                                                        • HeapFree.KERNEL32(00000000), ref: 00F10F95
                                                        • GetProcessHeap.KERNEL32(00000000,?), ref: 00F10FA1
                                                        • HeapFree.KERNEL32(00000000), ref: 00F10FA8
                                                          • Part of subcall function 00F11193: GetProcessHeap.KERNEL32(00000008,00F10BB1,?,00000000,?,00F10BB1,?), ref: 00F111A1
                                                          • Part of subcall function 00F11193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00F10BB1,?), ref: 00F111A8
                                                          • Part of subcall function 00F11193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00F10BB1,?), ref: 00F111B7
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
                                                        • String ID:
                                                        • API String ID: 4175595110-0
                                                        • Opcode ID: 3c8eed7b346b9fd9079c04dea586f226fb5013f29351a77caf03c62576219455
                                                        • Instruction ID: b1efc9aa92e0844f42437ca564d3f31ddedef93372943908242dafd60fc6af13
                                                        • Opcode Fuzzy Hash: 3c8eed7b346b9fd9079c04dea586f226fb5013f29351a77caf03c62576219455
                                                        • Instruction Fuzzy Hash: 8B718B7690120AEBDB209FA5DC45FEEBBB8FF05310F044115F919E6191DB709986DFA0
                                                        Function 00F3C3B7 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00F3C4BD
                                                        • RegCreateKeyExW.ADVAPI32(?,?,00000000,00F4CC08,00000000,?,00000000,?,?), ref: 00F3C544
                                                        • RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 00F3C5A4
                                                        • _wcslen.LIBCMT ref: 00F3C5F4
                                                        • _wcslen.LIBCMT ref: 00F3C66F
                                                        • RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 00F3C6B2
                                                        • RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 00F3C7C1
                                                        • RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 00F3C84D
                                                        • RegCloseKey.ADVAPI32(?), ref: 00F3C881
                                                        • RegCloseKey.ADVAPI32(00000000), ref: 00F3C88E
                                                        • RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 00F3C960
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Value$Close$_wcslen$ConnectCreateRegistry
                                                        • String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
                                                        • API String ID: 9721498-966354055
                                                        • Opcode ID: 0546e57d7afbf69838b93ed6fb14ec17210dd9b9de4deef2d0d344b01fa464d1
                                                        • Instruction ID: 8054458ed1b0cda66d9f99b4062f4b1dfeac8f1131b54181d87bc1707465934b
                                                        • Opcode Fuzzy Hash: 0546e57d7afbf69838b93ed6fb14ec17210dd9b9de4deef2d0d344b01fa464d1
                                                        • Instruction Fuzzy Hash: 37125A356042019FDB14DF14C881B6AB7E5EF88724F18885DF88AAB7A2DB31ED41DB91
                                                        Function 00F4091E Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CharUpperBuffW.USER32(?,?), ref: 00F409C6
                                                        • _wcslen.LIBCMT ref: 00F40A01
                                                        • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00F40A54
                                                        • _wcslen.LIBCMT ref: 00F40A8A
                                                        • _wcslen.LIBCMT ref: 00F40B06
                                                        • _wcslen.LIBCMT ref: 00F40B81
                                                          • Part of subcall function 00ECF9F2: _wcslen.LIBCMT ref: 00ECF9FD
                                                          • Part of subcall function 00F12BE8: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00F12BFA
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: _wcslen$MessageSend$BuffCharUpper
                                                        • String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
                                                        • API String ID: 1103490817-4258414348
                                                        • Opcode ID: 48ecd0b15ca7df0ecdb834ecedf4f5d8a05bc3b4afd3e114b77e0d6f24f0eaf7
                                                        • Instruction ID: 69d2247cc44d7f81424fb03bd3e8e91ebd5fceef903858d387844b3c813b22b6
                                                        • Opcode Fuzzy Hash: 48ecd0b15ca7df0ecdb834ecedf4f5d8a05bc3b4afd3e114b77e0d6f24f0eaf7
                                                        • Instruction Fuzzy Hash: A3E1AF316083018FC714EF24C45096ABBE2FFD8314B14895DF999AB362DB35ED46EB82
                                                        Function 00F3C998 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: _wcslen$BuffCharUpper
                                                        • String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
                                                        • API String ID: 1256254125-909552448
                                                        • Opcode ID: 80df72501befe0b59d9a6d9d17b6b0676467eed6c0dfa911787b87020839546f
                                                        • Instruction ID: 618f6b1ba2b42fb0dc2161c83ef4fa743d5f977e0c9bd24eaaf7bae54b30137c
                                                        • Opcode Fuzzy Hash: 80df72501befe0b59d9a6d9d17b6b0676467eed6c0dfa911787b87020839546f
                                                        • Instruction Fuzzy Hash: 4D71E533A1016A8BCF10DE7CCD516BB3391ABA0770F255129F855B7285E635CD45B3E1
                                                        Function 00F4833C Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • _wcslen.LIBCMT ref: 00F4835A
                                                        • _wcslen.LIBCMT ref: 00F4836E
                                                        • _wcslen.LIBCMT ref: 00F48391
                                                        • _wcslen.LIBCMT ref: 00F483B4
                                                        • LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00F483F2
                                                        • LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,00F4361A,?), ref: 00F4844E
                                                        • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00F48487
                                                        • LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00F484CA
                                                        • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00F48501
                                                        • FreeLibrary.KERNEL32(?), ref: 00F4850D
                                                        • ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00F4851D
                                                        • DestroyIcon.USER32(?), ref: 00F4852C
                                                        • SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00F48549
                                                        • SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00F48555
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
                                                        • String ID: .dll$.exe$.icl
                                                        • API String ID: 799131459-1154884017
                                                        • Opcode ID: 91fdd6a095a2bc925564c3ddbaff5151d487df5fff22a30463ed7c8ac9ec4ac6
                                                        • Instruction ID: a1f972f492c7d53788c7f8a036dc60554162c882fbbee889cbcc3f6a243063d1
                                                        • Opcode Fuzzy Hash: 91fdd6a095a2bc925564c3ddbaff5151d487df5fff22a30463ed7c8ac9ec4ac6
                                                        • Instruction Fuzzy Hash: 6061C071900219BBEB14DF64CC81BBE7BA8FF14761F10450AFD15E61D1EB74AA81EBA0
                                                        Function 00EB7778 Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 273COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
                                                        • API String ID: 0-1645009161
                                                        • Opcode ID: b19b36bdd232a966aac65f3ee9331f4fdbff1942f18d36b88ae4b6ac7b923e0f
                                                        • Instruction ID: d4d054f62562a356b6259084404a2c7e76ed4207923390e2119e531c07a14e8e
                                                        • Opcode Fuzzy Hash: b19b36bdd232a966aac65f3ee9331f4fdbff1942f18d36b88ae4b6ac7b923e0f
                                                        • Instruction Fuzzy Hash: 0581D471604619BBDB21AF60CD42FFF3BA5AF95300F046026FE45BA192EB70D912D691
                                                        Function 00F23E79 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 205COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CharLowerBuffW.USER32(?,?), ref: 00F23EF8
                                                        • _wcslen.LIBCMT ref: 00F23F03
                                                        • _wcslen.LIBCMT ref: 00F23F5A
                                                        • _wcslen.LIBCMT ref: 00F23F98
                                                        • GetDriveTypeW.KERNEL32(?), ref: 00F23FD6
                                                        • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00F2401E
                                                        • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00F24059
                                                        • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00F24087
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: SendString_wcslen$BuffCharDriveLowerType
                                                        • String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
                                                        • API String ID: 1839972693-4113822522
                                                        • Opcode ID: 9d246412cbce16c7bc9cfc3004d800fd40359f52b3f65f8f5e29887661446831
                                                        • Instruction ID: 16a6218d45ea5280bc2a4119dcfda2dc75a5bde11167ae720cc6cc59cef2e906
                                                        • Opcode Fuzzy Hash: 9d246412cbce16c7bc9cfc3004d800fd40359f52b3f65f8f5e29887661446831
                                                        • Instruction Fuzzy Hash: 1F711272A042129FC310DF24D8808ABB7F4EF94768F10892DF995A7251EB34ED49DB92
                                                        Function 00F15A1B Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • LoadIconW.USER32(00000063), ref: 00F15A2E
                                                        • SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00F15A40
                                                        • SetWindowTextW.USER32(?,?), ref: 00F15A57
                                                        • GetDlgItem.USER32(?,000003EA), ref: 00F15A6C
                                                        • SetWindowTextW.USER32(00000000,?), ref: 00F15A72
                                                        • GetDlgItem.USER32(?,000003E9), ref: 00F15A82
                                                        • SetWindowTextW.USER32(00000000,?), ref: 00F15A88
                                                        • SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00F15AA9
                                                        • SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00F15AC3
                                                        • GetWindowRect.USER32(?,?), ref: 00F15ACC
                                                        • _wcslen.LIBCMT ref: 00F15B33
                                                        • SetWindowTextW.USER32(?,?), ref: 00F15B6F
                                                        • GetDesktopWindow.USER32 ref: 00F15B75
                                                        • GetWindowRect.USER32(00000000), ref: 00F15B7C
                                                        • MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 00F15BD3
                                                        • GetClientRect.USER32(?,?), ref: 00F15BE0
                                                        • PostMessageW.USER32(?,00000005,00000000,?), ref: 00F15C05
                                                        • SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00F15C2F
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
                                                        • String ID:
                                                        • API String ID: 895679908-0
                                                        • Opcode ID: 03d12b18d9077f0e79b1305d6ec706b235172454c3161a6cc0eb537ee1c9bfc8
                                                        • Instruction ID: ceedbd8c0d0557b51cd6bdfb0017523651cdfc38be0578e619fdcd53ad09b97b
                                                        • Opcode Fuzzy Hash: 03d12b18d9077f0e79b1305d6ec706b235172454c3161a6cc0eb537ee1c9bfc8
                                                        • Instruction Fuzzy Hash: FE718F31900B09EFDB20DFA8CD85BAEBBF5FF88B14F104518E546A25A0D775E940DB50
                                                        Function 00F2FE0E Relevance: 27.1, APIs: 18, Instructions: 128COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • LoadCursorW.USER32(00000000,00007F89), ref: 00F2FE27
                                                        • LoadCursorW.USER32(00000000,00007F8A), ref: 00F2FE32
                                                        • LoadCursorW.USER32(00000000,00007F00), ref: 00F2FE3D
                                                        • LoadCursorW.USER32(00000000,00007F03), ref: 00F2FE48
                                                        • LoadCursorW.USER32(00000000,00007F8B), ref: 00F2FE53
                                                        • LoadCursorW.USER32(00000000,00007F01), ref: 00F2FE5E
                                                        • LoadCursorW.USER32(00000000,00007F81), ref: 00F2FE69
                                                        • LoadCursorW.USER32(00000000,00007F88), ref: 00F2FE74
                                                        • LoadCursorW.USER32(00000000,00007F80), ref: 00F2FE7F
                                                        • LoadCursorW.USER32(00000000,00007F86), ref: 00F2FE8A
                                                        • LoadCursorW.USER32(00000000,00007F83), ref: 00F2FE95
                                                        • LoadCursorW.USER32(00000000,00007F85), ref: 00F2FEA0
                                                        • LoadCursorW.USER32(00000000,00007F82), ref: 00F2FEAB
                                                        • LoadCursorW.USER32(00000000,00007F84), ref: 00F2FEB6
                                                        • LoadCursorW.USER32(00000000,00007F04), ref: 00F2FEC1
                                                        • LoadCursorW.USER32(00000000,00007F02), ref: 00F2FECC
                                                        • GetCursorInfo.USER32(?), ref: 00F2FEDC
                                                        • GetLastError.KERNEL32 ref: 00F2FF1E
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Cursor$Load$ErrorInfoLast
                                                        • String ID:
                                                        • API String ID: 3215588206-0
                                                        • Opcode ID: f08ee9d7b1104f7da6d32d079becd340a21d806ca902971fc926445f0feea0f9
                                                        • Instruction ID: 130e738e4f31413ef369e7cd73e9b733af4496dfa76810156d291a41bab7a0d7
                                                        • Opcode Fuzzy Hash: f08ee9d7b1104f7da6d32d079becd340a21d806ca902971fc926445f0feea0f9
                                                        • Instruction Fuzzy Hash: C34142B0D093196BDB109FBA9C8585EBFF8BF04364B54453AE11DEB281DB7899018E91
                                                        Function 00ED00C6 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • __scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 00ED00C6
                                                          • Part of subcall function 00ED00ED: InitializeCriticalSectionAndSpinCount.KERNEL32(00F8070C,00000FA0,77D4356C,?,?,?,?,00EF23B3,000000FF), ref: 00ED011C
                                                          • Part of subcall function 00ED00ED: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,00EF23B3,000000FF), ref: 00ED0127
                                                          • Part of subcall function 00ED00ED: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,00EF23B3,000000FF), ref: 00ED0138
                                                          • Part of subcall function 00ED00ED: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 00ED014E
                                                          • Part of subcall function 00ED00ED: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00ED015C
                                                          • Part of subcall function 00ED00ED: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00ED016A
                                                          • Part of subcall function 00ED00ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00ED0195
                                                          • Part of subcall function 00ED00ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00ED01A0
                                                        • ___scrt_fastfail.LIBCMT ref: 00ED00E7
                                                          • Part of subcall function 00ED00A3: __onexit.LIBCMT ref: 00ED00A9
                                                        Strings
                                                        • api-ms-win-core-synch-l1-2-0.dll, xrefs: 00ED0122
                                                        • InitializeConditionVariable, xrefs: 00ED0148
                                                        • kernel32.dll, xrefs: 00ED0133
                                                        • WakeAllConditionVariable, xrefs: 00ED0162
                                                        • SleepConditionVariableCS, xrefs: 00ED0154
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
                                                        • String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
                                                        • API String ID: 66158676-1714406822
                                                        • Opcode ID: f2d36194f2bbdf94ec668c9efc3839f1768fb24de446a1dcab9ca918a8941525
                                                        • Instruction ID: c9b42ee432957cf704efe347af26e22ea7e665cdd45a37debaa05f07eed407a1
                                                        • Opcode Fuzzy Hash: f2d36194f2bbdf94ec668c9efc3839f1768fb24de446a1dcab9ca918a8941525
                                                        • Instruction Fuzzy Hash: 11212632A423156FE7506BA4AC05B6E37E4EB45B61F04213BFC05F3391DF719801AAD1
                                                        Function 00F130F7 Relevance: 24.9, APIs: 8, Strings: 6, Instructions: 400COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: _wcslen
                                                        • String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
                                                        • API String ID: 176396367-1603158881
                                                        • Opcode ID: 1a8ff2334d23c0f313e06143f992067c415628dbc74ccd548df10d4a16db6e59
                                                        • Instruction ID: c29987a2b464ad35c78b6aa2cd4d079dc3ec952d6d474f8dea14666c14823112
                                                        • Opcode Fuzzy Hash: 1a8ff2334d23c0f313e06143f992067c415628dbc74ccd548df10d4a16db6e59
                                                        • Instruction Fuzzy Hash: 7BE1B632E00516ABCB18DFB8C4517EEFBB5BF54760F54812AE456B7240DB30AEC5AB90
                                                        Function 00F244C0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CharLowerBuffW.USER32(00000000,00000000,00F4CC08), ref: 00F24527
                                                        • _wcslen.LIBCMT ref: 00F2453B
                                                        • _wcslen.LIBCMT ref: 00F24599
                                                        • _wcslen.LIBCMT ref: 00F245F4
                                                        • _wcslen.LIBCMT ref: 00F2463F
                                                        • _wcslen.LIBCMT ref: 00F246A7
                                                          • Part of subcall function 00ECF9F2: _wcslen.LIBCMT ref: 00ECF9FD
                                                        • GetDriveTypeW.KERNEL32(?,00F76BF0,00000061), ref: 00F24743
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: _wcslen$BuffCharDriveLowerType
                                                        • String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
                                                        • API String ID: 2055661098-1000479233
                                                        • Opcode ID: 6cf1ea8bec598ebd28b55953e2b310c5cc63e48d00dcba656f06b8359017101b
                                                        • Instruction ID: 3938058ae12b697392a65e7d255a8181bbb7bdbd0d7ce2153143ca36fa146bb9
                                                        • Opcode Fuzzy Hash: 6cf1ea8bec598ebd28b55953e2b310c5cc63e48d00dcba656f06b8359017101b
                                                        • Instruction Fuzzy Hash: CBB11231A083229FC710DF28E891A6BB7E5AFE5720F10591DF496D7291D7B0E844DB92
                                                        Function 00F33FE9 Relevance: 23.2, APIs: 11, Strings: 2, Instructions: 478libraryloaderCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • LoadLibraryA.KERNEL32(kernel32.dll,?,00F4CC08), ref: 00F340BB
                                                        • GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00F340CD
                                                        • GetModuleFileNameW.KERNEL32(?,?,00000104,?,?,?,00F4CC08), ref: 00F340F2
                                                        • FreeLibrary.KERNEL32(00000000,?,00F4CC08), ref: 00F3413E
                                                        • StringFromGUID2.OLE32(?,?,00000028,?,00F4CC08), ref: 00F341A8
                                                        • SysFreeString.OLEAUT32(00000009), ref: 00F34262
                                                        • QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00F342C8
                                                        • SysFreeString.OLEAUT32(?), ref: 00F342F2
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: FreeString$Library$AddressFileFromLoadModuleNamePathProcQueryType
                                                        • String ID: GetModuleHandleExW$kernel32.dll
                                                        • API String ID: 354098117-199464113
                                                        • Opcode ID: 5c4eec8ef2c318a95150a4a673bab67a86b612f0b4aef77a84a40b9ee49912d4
                                                        • Instruction ID: 5ee72d88e980d4bb22b5cbd07766484294e2a5a94be7306a8ca49a3fd41d7cc7
                                                        • Opcode Fuzzy Hash: 5c4eec8ef2c318a95150a4a673bab67a86b612f0b4aef77a84a40b9ee49912d4
                                                        • Instruction Fuzzy Hash: A8121B75A00119EFDB14DF94C884EAEBBB5FF45324F248098E905AB261D731FD86DBA0
                                                        Function 00EB326F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetMenuItemCount.USER32(00F81990), ref: 00EF2F8D
                                                        • GetMenuItemCount.USER32(00F81990), ref: 00EF303D
                                                        • GetCursorPos.USER32(?), ref: 00EF3081
                                                        • SetForegroundWindow.USER32(00000000), ref: 00EF308A
                                                        • TrackPopupMenuEx.USER32(00F81990,00000000,?,00000000,00000000,00000000), ref: 00EF309D
                                                        • PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00EF30A9
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
                                                        • String ID: 0
                                                        • API String ID: 36266755-4108050209
                                                        • Opcode ID: 51571ea7d89d3c42b0f5bb3be2b269818a31a75fe065be2d7a5c3616b5b59306
                                                        • Instruction ID: 1b79ed424325dbe3415397092aa35efd144f88823e6938252dfd490c674bf3a8
                                                        • Opcode Fuzzy Hash: 51571ea7d89d3c42b0f5bb3be2b269818a31a75fe065be2d7a5c3616b5b59306
                                                        • Instruction Fuzzy Hash: EF71E771744209BAEB218F64CC49FEABF68FF05368F245216FB147A1E0C7B1A950DB90
                                                        Function 00F46CD9 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • DestroyWindow.USER32(00000000,?), ref: 00F46DEB
                                                          • Part of subcall function 00EB6B57: _wcslen.LIBCMT ref: 00EB6B6A
                                                        • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00F46E5F
                                                        • SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00F46E81
                                                        • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00F46E94
                                                        • DestroyWindow.USER32(?), ref: 00F46EB5
                                                        • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00EB0000,00000000), ref: 00F46EE4
                                                        • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00F46EFD
                                                        • GetDesktopWindow.USER32 ref: 00F46F16
                                                        • GetWindowRect.USER32(00000000), ref: 00F46F1D
                                                        • SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00F46F35
                                                        • SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00F46F4D
                                                          • Part of subcall function 00EC9944: GetWindowLongW.USER32(?,000000EB), ref: 00EC9952
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
                                                        • String ID: 0$tooltips_class32
                                                        • API String ID: 2429346358-3619404913
                                                        • Opcode ID: 3975cec914a8035473c524fbaf6f3250fb223eb8b852fd52e6a90f1a41ba9a54
                                                        • Instruction ID: 2470e99cec1dc2901df822fb71c020cd095ca0a9bbf9d045a223399c1e6d4acb
                                                        • Opcode Fuzzy Hash: 3975cec914a8035473c524fbaf6f3250fb223eb8b852fd52e6a90f1a41ba9a54
                                                        • Instruction Fuzzy Hash: 14718774504344AFEB20CF18D844BBABBE9FB8A324F04451DF999D7261D770E90AEB16
                                                        Function 00F4911E Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 181windowfileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EC9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00EC9BB2
                                                        • DragQueryPoint.SHELL32(?,?), ref: 00F49147
                                                          • Part of subcall function 00F47674: ClientToScreen.USER32(?,?), ref: 00F4769A
                                                          • Part of subcall function 00F47674: GetWindowRect.USER32(?,?), ref: 00F47710
                                                          • Part of subcall function 00F47674: PtInRect.USER32(?,?,00F48B89), ref: 00F47720
                                                        • SendMessageW.USER32(?,000000B0,?,?), ref: 00F491B0
                                                        • DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00F491BB
                                                        • DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00F491DE
                                                        • SendMessageW.USER32(?,000000C2,00000001,?), ref: 00F49225
                                                        • SendMessageW.USER32(?,000000B0,?,?), ref: 00F4923E
                                                        • SendMessageW.USER32(?,000000B1,?,?), ref: 00F49255
                                                        • SendMessageW.USER32(?,000000B1,?,?), ref: 00F49277
                                                        • DragFinish.SHELL32(?), ref: 00F4927E
                                                        • DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00F49371
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
                                                        • String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
                                                        • API String ID: 221274066-3440237614
                                                        • Opcode ID: a24e33164e5f47f36878c7741bcfef0df5d7e73590d336687408fbd582cbe0bc
                                                        • Instruction ID: 24b5c0c4a33e6b6c3686e888d52caf7bedd50ac8dc85d633f369f845247df59e
                                                        • Opcode Fuzzy Hash: a24e33164e5f47f36878c7741bcfef0df5d7e73590d336687408fbd582cbe0bc
                                                        • Instruction Fuzzy Hash: 1B618C71108304AFD701EF60DC85DAFBBE8EF99350F10192EF995A31A1DB709A09DB92
                                                        Function 00F2C476 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00F2C4B0
                                                        • GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 00F2C4C3
                                                        • SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 00F2C4D7
                                                        • HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00F2C4F0
                                                        • InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 00F2C533
                                                        • InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00F2C549
                                                        • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00F2C554
                                                        • HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00F2C584
                                                        • GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 00F2C5DC
                                                        • SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 00F2C5F0
                                                        • InternetCloseHandle.WININET(00000000), ref: 00F2C5FB
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
                                                        • String ID:
                                                        • API String ID: 3800310941-3916222277
                                                        • Opcode ID: e56de3e5f661b2b7a4a50ce5c6706cc80118d14076bf139ae12999a83ededaa9
                                                        • Instruction ID: 2b52e68bacb49afef922823da0e8e81fb4514cb524ffb26b1724053723df13dd
                                                        • Opcode Fuzzy Hash: e56de3e5f661b2b7a4a50ce5c6706cc80118d14076bf139ae12999a83ededaa9
                                                        • Instruction Fuzzy Hash: C4519AB5500618BFEB218FA0DD88AAF7BFCFF19354F04401AF94596210DB34EA04ABA0
                                                        Function 00F4856F Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?), ref: 00F48592
                                                        • GetFileSize.KERNEL32(00000000,00000000), ref: 00F485A2
                                                        • GlobalAlloc.KERNEL32(00000002,00000000), ref: 00F485AD
                                                        • CloseHandle.KERNEL32(00000000), ref: 00F485BA
                                                        • GlobalLock.KERNEL32(00000000), ref: 00F485C8
                                                        • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00F485D7
                                                        • GlobalUnlock.KERNEL32(00000000), ref: 00F485E0
                                                        • CloseHandle.KERNEL32(00000000), ref: 00F485E7
                                                        • CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 00F485F8
                                                        • OleLoadPicture.OLEAUT32(?,00000000,00000000,00F4FC38,?), ref: 00F48611
                                                        • GlobalFree.KERNEL32(00000000), ref: 00F48621
                                                        • GetObjectW.GDI32(?,00000018,000000FF), ref: 00F48641
                                                        • CopyImage.USER32(?,00000000,00000000,?,00002000), ref: 00F48671
                                                        • DeleteObject.GDI32(00000000), ref: 00F48699
                                                        • SendMessageW.USER32(?,00000172,00000000,00000000), ref: 00F486AF
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
                                                        • String ID:
                                                        • API String ID: 3840717409-0
                                                        • Opcode ID: 865a5e78c144e9b232596a5e14809317f8626f0455a65c88285fb44d56279c9b
                                                        • Instruction ID: 69d0d1524baba183b36926712182199e5a2bec33c15c803c7bdbdab35dc43b23
                                                        • Opcode Fuzzy Hash: 865a5e78c144e9b232596a5e14809317f8626f0455a65c88285fb44d56279c9b
                                                        • Instruction Fuzzy Hash: 01414B75601208AFDB519FA5CC48EAE7BB8EF9A761F144058FD09E7260DB709E01EB60
                                                        Function 00F214BD Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 360timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • VariantInit.OLEAUT32(00000000), ref: 00F21502
                                                        • VariantCopy.OLEAUT32(?,?), ref: 00F2150B
                                                        • VariantClear.OLEAUT32(?), ref: 00F21517
                                                        • VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 00F215FB
                                                        • VarR8FromDec.OLEAUT32(?,?), ref: 00F21657
                                                        • VariantInit.OLEAUT32(?), ref: 00F21708
                                                        • SysFreeString.OLEAUT32(?), ref: 00F2178C
                                                        • VariantClear.OLEAUT32(?), ref: 00F217D8
                                                        • VariantClear.OLEAUT32(?), ref: 00F217E7
                                                        • VariantInit.OLEAUT32(00000000), ref: 00F21823
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem
                                                        • String ID: %4d%02d%02d%02d%02d%02d$Default
                                                        • API String ID: 1234038744-3931177956
                                                        • Opcode ID: 7cd5da29e8edeb25dae17b611d541bc792e7506fd305fd2523d35c7941cb5197
                                                        • Instruction ID: 98ca9ce2895b3449229d75b76cde5c457f1ce47ccc40bbf0fed0ce34a74ac24a
                                                        • Opcode Fuzzy Hash: 7cd5da29e8edeb25dae17b611d541bc792e7506fd305fd2523d35c7941cb5197
                                                        • Instruction Fuzzy Hash: 62D11432A00125DBDB10DF65E886BBDB7F5BF55700F18809AF806AB180DB34DC41EBA6
                                                        Function 00F3B60E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EB9CB3: _wcslen.LIBCMT ref: 00EB9CBD
                                                          • Part of subcall function 00F3C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00F3B6AE,?,?), ref: 00F3C9B5
                                                          • Part of subcall function 00F3C998: _wcslen.LIBCMT ref: 00F3C9F1
                                                          • Part of subcall function 00F3C998: _wcslen.LIBCMT ref: 00F3CA68
                                                          • Part of subcall function 00F3C998: _wcslen.LIBCMT ref: 00F3CA9E
                                                        • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00F3B6F4
                                                        • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00F3B772
                                                        • RegDeleteValueW.ADVAPI32(?,?), ref: 00F3B80A
                                                        • RegCloseKey.ADVAPI32(?), ref: 00F3B87E
                                                        • RegCloseKey.ADVAPI32(?), ref: 00F3B89C
                                                        • LoadLibraryA.KERNEL32(advapi32.dll), ref: 00F3B8F2
                                                        • GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00F3B904
                                                        • RegDeleteKeyW.ADVAPI32(?,?), ref: 00F3B922
                                                        • FreeLibrary.KERNEL32(00000000), ref: 00F3B983
                                                        • RegCloseKey.ADVAPI32(00000000), ref: 00F3B994
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: _wcslen$Close$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
                                                        • String ID: RegDeleteKeyExW$advapi32.dll
                                                        • API String ID: 146587525-4033151799
                                                        • Opcode ID: 355c65cb7521db7d670cf235aee5a192f8c72c499014aa7987dd680d0f5a23f2
                                                        • Instruction ID: b4d16bd0f27961e40812d3318d5bd7582aac2eb2998177dc42f04c8d5022de22
                                                        • Opcode Fuzzy Hash: 355c65cb7521db7d670cf235aee5a192f8c72c499014aa7987dd680d0f5a23f2
                                                        • Instruction Fuzzy Hash: D4C1BE34609201AFD710DF14C4A5F2ABBE5FF84328F18949CF59A9B2A2CB35EC45DB91
                                                        Function 00F3255C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetDC.USER32(00000000), ref: 00F325D8
                                                        • CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00F325E8
                                                        • CreateCompatibleDC.GDI32(?), ref: 00F325F4
                                                        • SelectObject.GDI32(00000000,?), ref: 00F32601
                                                        • StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 00F3266D
                                                        • GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 00F326AC
                                                        • GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 00F326D0
                                                        • SelectObject.GDI32(?,?), ref: 00F326D8
                                                        • DeleteObject.GDI32(?), ref: 00F326E1
                                                        • DeleteDC.GDI32(?), ref: 00F326E8
                                                        • ReleaseDC.USER32(00000000,?), ref: 00F326F3
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
                                                        • String ID: (
                                                        • API String ID: 2598888154-3887548279
                                                        • Opcode ID: 29b3b6c2085a1ad724fac90c47fb72180f479d608edfaa4974fb71b54f2161b5
                                                        • Instruction ID: eb167b42323c6c110e7be7787bdd9e75da768f7b87460ad9b3dc5f341bd3fa7e
                                                        • Opcode Fuzzy Hash: 29b3b6c2085a1ad724fac90c47fb72180f479d608edfaa4974fb71b54f2161b5
                                                        • Instruction Fuzzy Hash: 6A61F175D00219EFCF44CFA8D885AAEBBB6FF48310F208529E955A7250E774A941DFA0
                                                        Function 00EEDA5D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • ___free_lconv_mon.LIBCMT ref: 00EEDAA1
                                                          • Part of subcall function 00EED63C: _free.LIBCMT ref: 00EED659
                                                          • Part of subcall function 00EED63C: _free.LIBCMT ref: 00EED66B
                                                          • Part of subcall function 00EED63C: _free.LIBCMT ref: 00EED67D
                                                          • Part of subcall function 00EED63C: _free.LIBCMT ref: 00EED68F
                                                          • Part of subcall function 00EED63C: _free.LIBCMT ref: 00EED6A1
                                                          • Part of subcall function 00EED63C: _free.LIBCMT ref: 00EED6B3
                                                          • Part of subcall function 00EED63C: _free.LIBCMT ref: 00EED6C5
                                                          • Part of subcall function 00EED63C: _free.LIBCMT ref: 00EED6D7
                                                          • Part of subcall function 00EED63C: _free.LIBCMT ref: 00EED6E9
                                                          • Part of subcall function 00EED63C: _free.LIBCMT ref: 00EED6FB
                                                          • Part of subcall function 00EED63C: _free.LIBCMT ref: 00EED70D
                                                          • Part of subcall function 00EED63C: _free.LIBCMT ref: 00EED71F
                                                          • Part of subcall function 00EED63C: _free.LIBCMT ref: 00EED731
                                                        • _free.LIBCMT ref: 00EEDA96
                                                          • Part of subcall function 00EE29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00EED7D1,00000000,00000000,00000000,00000000,?,00EED7F8,00000000,00000007,00000000,?,00EEDBF5,00000000), ref: 00EE29DE
                                                          • Part of subcall function 00EE29C8: GetLastError.KERNEL32(00000000,?,00EED7D1,00000000,00000000,00000000,00000000,?,00EED7F8,00000000,00000007,00000000,?,00EEDBF5,00000000,00000000), ref: 00EE29F0
                                                        • _free.LIBCMT ref: 00EEDAB8
                                                        • _free.LIBCMT ref: 00EEDACD
                                                        • _free.LIBCMT ref: 00EEDAD8
                                                        • _free.LIBCMT ref: 00EEDAFA
                                                        • _free.LIBCMT ref: 00EEDB0D
                                                        • _free.LIBCMT ref: 00EEDB1B
                                                        • _free.LIBCMT ref: 00EEDB26
                                                        • _free.LIBCMT ref: 00EEDB5E
                                                        • _free.LIBCMT ref: 00EEDB65
                                                        • _free.LIBCMT ref: 00EEDB82
                                                        • _free.LIBCMT ref: 00EEDB9A
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: _free$ErrorFreeHeapLast___free_lconv_mon
                                                        • String ID:
                                                        • API String ID: 161543041-0
                                                        • Opcode ID: 42e2ae0cfc3af2cdaa4ecae9f418430e4861a8cbfd578f08be02dd375f85a6e1
                                                        • Instruction ID: 86be24c2cf5d150e67b03d98a587f5bb85cba3d200ab7a030b27fd12da1f3412
                                                        • Opcode Fuzzy Hash: 42e2ae0cfc3af2cdaa4ecae9f418430e4861a8cbfd578f08be02dd375f85a6e1
                                                        • Instruction Fuzzy Hash: AA315E3160868D9FDB21AE3AEC46B5A77E8FF40318F11642DE558E7192EB36AD408720
                                                        Function 00F1365B Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 267windowtimeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetClassNameW.USER32(?,?,00000100), ref: 00F1369C
                                                        • _wcslen.LIBCMT ref: 00F136A7
                                                        • SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00F13797
                                                        • GetClassNameW.USER32(?,?,00000400), ref: 00F1380C
                                                        • GetDlgCtrlID.USER32(?), ref: 00F1385D
                                                        • GetWindowRect.USER32(?,?), ref: 00F13882
                                                        • GetParent.USER32(?), ref: 00F138A0
                                                        • ScreenToClient.USER32(00000000), ref: 00F138A7
                                                        • GetClassNameW.USER32(?,?,00000100), ref: 00F13921
                                                        • GetWindowTextW.USER32(?,?,00000400), ref: 00F1395D
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout_wcslen
                                                        • String ID: %s%u
                                                        • API String ID: 4010501982-679674701
                                                        • Opcode ID: 00c55509024af82fc1e900d12174ac6a02755f4046a426470138df9242581e39
                                                        • Instruction ID: 679ecf8e894c4c09e14e6ab4756b079d15cc5e82012de2f2edbc56ed5dd150c1
                                                        • Opcode Fuzzy Hash: 00c55509024af82fc1e900d12174ac6a02755f4046a426470138df9242581e39
                                                        • Instruction Fuzzy Hash: 6F91E271604606AFD718DF24C885FEAF7E9FF44360F408629F999D2190DB30EA85DBA1
                                                        Function 00F14954 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 253COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetClassNameW.USER32(?,?,00000400), ref: 00F14994
                                                        • GetWindowTextW.USER32(?,?,00000400), ref: 00F149DA
                                                        • _wcslen.LIBCMT ref: 00F149EB
                                                        • CharUpperBuffW.USER32(?,00000000), ref: 00F149F7
                                                        • _wcsstr.LIBVCRUNTIME ref: 00F14A2C
                                                        • GetClassNameW.USER32(00000018,?,00000400), ref: 00F14A64
                                                        • GetWindowTextW.USER32(?,?,00000400), ref: 00F14A9D
                                                        • GetClassNameW.USER32(00000018,?,00000400), ref: 00F14AE6
                                                        • GetClassNameW.USER32(?,?,00000400), ref: 00F14B20
                                                        • GetWindowRect.USER32(?,?), ref: 00F14B8B
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
                                                        • String ID: ThumbnailClass
                                                        • API String ID: 1311036022-1241985126
                                                        • Opcode ID: f72469115a6a731610f9d295d612164a76dfd3cb100ab8e397201770f7c15c9b
                                                        • Instruction ID: 1db17bc83b11da31d1e6aa27f5322728fec72b8fbf4ac5a4e36bf55bf34b10f7
                                                        • Opcode Fuzzy Hash: f72469115a6a731610f9d295d612164a76dfd3cb100ab8e397201770f7c15c9b
                                                        • Instruction Fuzzy Hash: 24919F724082099FDB04CF14C985BEA77E8FFC4364F04846AFD899A196DB34ED85DBA1
                                                        Function 00F1BF30 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 190windowsleepCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetMenuItemInfoW.USER32(00F81990,000000FF,00000000,00000030), ref: 00F1BFAC
                                                        • SetMenuItemInfoW.USER32(00F81990,00000004,00000000,00000030), ref: 00F1BFE1
                                                        • Sleep.KERNEL32(000001F4), ref: 00F1BFF3
                                                        • GetMenuItemCount.USER32(?), ref: 00F1C039
                                                        • GetMenuItemID.USER32(?,00000000), ref: 00F1C056
                                                        • GetMenuItemID.USER32(?,-00000001), ref: 00F1C082
                                                        • GetMenuItemID.USER32(?,?), ref: 00F1C0C9
                                                        • CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00F1C10F
                                                        • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00F1C124
                                                        • SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00F1C145
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: ItemMenu$Info$CheckCountRadioSleep
                                                        • String ID: 0
                                                        • API String ID: 1460738036-4108050209
                                                        • Opcode ID: 447a8c516d8ef2dc87cefe8fe4841963ed605e16a6fbcf2880dbe3a729716c1e
                                                        • Instruction ID: edca7967fcd5e8cda6ccb607d4c77394f5edd142ccb1d0c309e67f22c0acd739
                                                        • Opcode Fuzzy Hash: 447a8c516d8ef2dc87cefe8fe4841963ed605e16a6fbcf2880dbe3a729716c1e
                                                        • Instruction Fuzzy Hash: 56618DB198024AEFDF11CF64DD88AEEBBB8FB06354F044155F851A3291C735AD85EBA0
                                                        Function 00F3CC34 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 00F3CC64
                                                        • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 00F3CC8D
                                                        • FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 00F3CD48
                                                          • Part of subcall function 00F3CC34: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 00F3CCAA
                                                          • Part of subcall function 00F3CC34: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 00F3CCBD
                                                          • Part of subcall function 00F3CC34: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00F3CCCF
                                                          • Part of subcall function 00F3CC34: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 00F3CD05
                                                          • Part of subcall function 00F3CC34: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 00F3CD28
                                                        • RegDeleteKeyW.ADVAPI32(?,?), ref: 00F3CCF3
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
                                                        • String ID: RegDeleteKeyExW$advapi32.dll
                                                        • API String ID: 2734957052-4033151799
                                                        • Opcode ID: f096b9821f2d49488d0af68d2a734e67bd3835d2841d75c10d79383bb6827c88
                                                        • Instruction ID: c3f68ac3756f9927f47a53828dd58a3b7494b1f4e148e21b785d39d557f89f25
                                                        • Opcode Fuzzy Hash: f096b9821f2d49488d0af68d2a734e67bd3835d2841d75c10d79383bb6827c88
                                                        • Instruction Fuzzy Hash: 12316B75902128BBDB209B55DC88EEFBB7CEF56760F000165F915E2240DA349A45EBE0
                                                        Function 00F23D1E Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00F23D40
                                                        • _wcslen.LIBCMT ref: 00F23D6D
                                                        • CreateDirectoryW.KERNEL32(?,00000000), ref: 00F23D9D
                                                        • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00F23DBE
                                                        • RemoveDirectoryW.KERNEL32(?), ref: 00F23DCE
                                                        • DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00F23E55
                                                        • CloseHandle.KERNEL32(00000000), ref: 00F23E60
                                                        • CloseHandle.KERNEL32(00000000), ref: 00F23E6B
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove_wcslen
                                                        • String ID: :$\$\??\%s
                                                        • API String ID: 1149970189-3457252023
                                                        • Opcode ID: bb6725fba222608f4a6bdbed8f4a62d586bce7cb90c305ef27c2e820fb6244fd
                                                        • Instruction ID: adbfa143d55796c56ebaace73a9402b913237b36d2feace228126fc294719f1b
                                                        • Opcode Fuzzy Hash: bb6725fba222608f4a6bdbed8f4a62d586bce7cb90c305ef27c2e820fb6244fd
                                                        • Instruction Fuzzy Hash: 5F31C3B6A0011DABDB209FA0DC48FEF37BCEF89710F5040A6F909E6160E77497449B64
                                                        Function 00F1E6B0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • timeGetTime.WINMM ref: 00F1E6B4
                                                          • Part of subcall function 00ECE551: timeGetTime.WINMM(?,?,00F1E6D4), ref: 00ECE555
                                                        • Sleep.KERNEL32(0000000A), ref: 00F1E6E1
                                                        • EnumThreadWindows.USER32(?,Function_0006E665,00000000), ref: 00F1E705
                                                        • FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00F1E727
                                                        • SetActiveWindow.USER32 ref: 00F1E746
                                                        • SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00F1E754
                                                        • SendMessageW.USER32(00000010,00000000,00000000), ref: 00F1E773
                                                        • Sleep.KERNEL32(000000FA), ref: 00F1E77E
                                                        • IsWindow.USER32 ref: 00F1E78A
                                                        • EndDialog.USER32(00000000), ref: 00F1E79B
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
                                                        • String ID: BUTTON
                                                        • API String ID: 1194449130-3405671355
                                                        • Opcode ID: afa69f82eeeb93739fe0170fe3dca188994f9bbdf5a9b697cbab83d18ede5b74
                                                        • Instruction ID: 6aca2bee6ece5ba8847068eb304e462ac9451b67f85ae5662983b41adcf3c579
                                                        • Opcode Fuzzy Hash: afa69f82eeeb93739fe0170fe3dca188994f9bbdf5a9b697cbab83d18ede5b74
                                                        • Instruction Fuzzy Hash: DD21D57420120CAFFB405F20EC89FB53BA9FBA6758F046424FD15821B1EB75AC40BBA4
                                                        Function 00F1E9FC Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EB9CB3: _wcslen.LIBCMT ref: 00EB9CBD
                                                        • mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00F1EA5D
                                                        • mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00F1EA73
                                                        • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00F1EA84
                                                        • mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00F1EA96
                                                        • mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00F1EAA7
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: SendString$_wcslen
                                                        • String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
                                                        • API String ID: 2420728520-1007645807
                                                        • Opcode ID: cab8431419c7b71b1639a0af5e165c04151620d5eb995f676e05af2d776f8510
                                                        • Instruction ID: 9acb202212c2d63ff44dad6aa9ec86d14c525c174d7f5633b0b873124c47317d
                                                        • Opcode Fuzzy Hash: cab8431419c7b71b1639a0af5e165c04151620d5eb995f676e05af2d776f8510
                                                        • Instruction Fuzzy Hash: A111A331A5021979D720A7A1DC4ADFF6EBCEFD1F10F40442AB915E20D1EE704945D5B2
                                                        Function 00F19F91 Relevance: 18.2, APIs: 12, Instructions: 188keyboardCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetKeyboardState.USER32(?), ref: 00F1A012
                                                        • SetKeyboardState.USER32(?), ref: 00F1A07D
                                                        • GetAsyncKeyState.USER32(000000A0), ref: 00F1A09D
                                                        • GetKeyState.USER32(000000A0), ref: 00F1A0B4
                                                        • GetAsyncKeyState.USER32(000000A1), ref: 00F1A0E3
                                                        • GetKeyState.USER32(000000A1), ref: 00F1A0F4
                                                        • GetAsyncKeyState.USER32(00000011), ref: 00F1A120
                                                        • GetKeyState.USER32(00000011), ref: 00F1A12E
                                                        • GetAsyncKeyState.USER32(00000012), ref: 00F1A157
                                                        • GetKeyState.USER32(00000012), ref: 00F1A165
                                                        • GetAsyncKeyState.USER32(0000005B), ref: 00F1A18E
                                                        • GetKeyState.USER32(0000005B), ref: 00F1A19C
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: State$Async$Keyboard
                                                        • String ID:
                                                        • API String ID: 541375521-0
                                                        • Opcode ID: f70997b506fc29865fbdbe713b80414f71aa24f34c0baaa1a74b1d2b0cf3185c
                                                        • Instruction ID: e6c5187bdf148cb673867df5f848121f925e066f921302e071b82e30a41f81ce
                                                        • Opcode Fuzzy Hash: f70997b506fc29865fbdbe713b80414f71aa24f34c0baaa1a74b1d2b0cf3185c
                                                        • Instruction Fuzzy Hash: DD51DB64D097C839FB35EB7048117EABFF45F12390F088599D5C2571C2DAA49ACCDBA2
                                                        Function 00F15CC6 Relevance: 18.2, APIs: 12, Instructions: 173COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetDlgItem.USER32(?,00000001), ref: 00F15CE2
                                                        • GetWindowRect.USER32(00000000,?), ref: 00F15CFB
                                                        • MoveWindow.USER32(?,0000000A,00000004,?,?,00000004,00000000), ref: 00F15D59
                                                        • GetDlgItem.USER32(?,00000002), ref: 00F15D69
                                                        • GetWindowRect.USER32(00000000,?), ref: 00F15D7B
                                                        • MoveWindow.USER32(?,?,00000004,00000000,?,00000004,00000000), ref: 00F15DCF
                                                        • GetDlgItem.USER32(?,000003E9), ref: 00F15DDD
                                                        • GetWindowRect.USER32(00000000,?), ref: 00F15DEF
                                                        • MoveWindow.USER32(?,0000000A,00000000,?,00000004,00000000), ref: 00F15E31
                                                        • GetDlgItem.USER32(?,000003EA), ref: 00F15E44
                                                        • MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00F15E5A
                                                        • InvalidateRect.USER32(?,00000000,00000001), ref: 00F15E67
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Window$ItemMoveRect$Invalidate
                                                        • String ID:
                                                        • API String ID: 3096461208-0
                                                        • Opcode ID: f412f069682e2947862383ea74b308eafadea9427813e7bb275f736358af8bb5
                                                        • Instruction ID: 108350c0ef36c7aafbfdffb5a39554ff01a51a2c171984223eb0fafbc84f30e6
                                                        • Opcode Fuzzy Hash: f412f069682e2947862383ea74b308eafadea9427813e7bb275f736358af8bb5
                                                        • Instruction Fuzzy Hash: D2513D74F00609AFDF18CF68DD89AAEBBB5EB98710F118128F905E7290D7709E40DB50
                                                        Function 00EC8BCD Relevance: 18.2, APIs: 12, Instructions: 168timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EC8F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00EC8BE8,?,00000000,?,?,?,?,00EC8BBA,00000000,?), ref: 00EC8FC5
                                                        • DestroyWindow.USER32(?), ref: 00EC8C81
                                                        • KillTimer.USER32(00000000,?,?,?,?,00EC8BBA,00000000,?), ref: 00EC8D1B
                                                        • DestroyAcceleratorTable.USER32(00000000), ref: 00F06973
                                                        • ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,00EC8BBA,00000000,?), ref: 00F069A1
                                                        • ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,00EC8BBA,00000000,?), ref: 00F069B8
                                                        • ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00EC8BBA,00000000), ref: 00F069D4
                                                        • DeleteObject.GDI32(00000000), ref: 00F069E6
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
                                                        • String ID:
                                                        • API String ID: 641708696-0
                                                        • Opcode ID: 5cfccd4026e4d953e70dac0cf0a9082253eb2e544866fa89197e4aec70f3b1ce
                                                        • Instruction ID: 5a3f2c634827aeac176bd931214c8bf05c859a5f27840cebbc3d73b41d359fa7
                                                        • Opcode Fuzzy Hash: 5cfccd4026e4d953e70dac0cf0a9082253eb2e544866fa89197e4aec70f3b1ce
                                                        • Instruction Fuzzy Hash: 0F61AC30502608DFDB259F14CB48FA9B7F1FB51326F10661DE442A69A0CB36AC92FB91
                                                        Function 00EC9838 Relevance: 18.1, APIs: 12, Instructions: 137COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EC9944: GetWindowLongW.USER32(?,000000EB), ref: 00EC9952
                                                        • GetSysColor.USER32(0000000F), ref: 00EC9862
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: ColorLongWindow
                                                        • String ID:
                                                        • API String ID: 259745315-0
                                                        • Opcode ID: 4b55f75d12b4bf863f94039a33b239e32acc17f705997016a93692a9971d2114
                                                        • Instruction ID: 5c58d12bc10d37294c1ff03cd9854a7f5dcf0bae449761af7923e10298e89c4c
                                                        • Opcode Fuzzy Hash: 4b55f75d12b4bf863f94039a33b239e32acc17f705997016a93692a9971d2114
                                                        • Instruction Fuzzy Hash: FE4103365016449FDB245F389C88FB93BA5BB57330F186649F9A2971E2C7329C42EB50
                                                        Function 00EE8D45 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 300COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: .
                                                        • API String ID: 0-3963672497
                                                        • Opcode ID: 88776349c0583217accb73a7b8b812d3b9583b13a3f6a86ba017adbc43470d90
                                                        • Instruction ID: bb86d705a35182c44abb2bc0ff3068f0bdf3d3d7eee711a24b72f08112b0d428
                                                        • Opcode Fuzzy Hash: 88776349c0583217accb73a7b8b812d3b9583b13a3f6a86ba017adbc43470d90
                                                        • Instruction Fuzzy Hash: F9C1E374A0428DAFCB11DFAAC841BEDBBF4AF49314F446199E919BB393C7309941CB60
                                                        Function 00F196E2 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,?,?,00EFF7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?), ref: 00F19717
                                                        • LoadStringW.USER32(00000000,?,00EFF7F8,00000001), ref: 00F19720
                                                          • Part of subcall function 00EB9CB3: _wcslen.LIBCMT ref: 00EB9CBD
                                                        • GetModuleHandleW.KERNEL32(00000000,00000001,?,00000FFF,?,?,00EFF7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?,00000000), ref: 00F19742
                                                        • LoadStringW.USER32(00000000,?,00EFF7F8,00000001), ref: 00F19745
                                                        • MessageBoxW.USER32(00000000,00000000,?,00011010), ref: 00F19866
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: HandleLoadModuleString$Message_wcslen
                                                        • String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
                                                        • API String ID: 747408836-2268648507
                                                        • Opcode ID: b4f49eb4134418c9b59dcea9ee5f5247623de07c7d9cd74f2f361093b85cf86f
                                                        • Instruction ID: 652508c8cfdea2bddb3451182abb6f6d56f80867b33d9f39a1fbef296f01cd27
                                                        • Opcode Fuzzy Hash: b4f49eb4134418c9b59dcea9ee5f5247623de07c7d9cd74f2f361093b85cf86f
                                                        • Instruction Fuzzy Hash: B9414072804209AACF04EBE0DD96EEFB7B8AF55340F601065F60572092EB756F48DBA1
                                                        Function 00F106DE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EB6B57: _wcslen.LIBCMT ref: 00EB6B6A
                                                        • WNetAddConnection2W.MPR(?,?,?,00000000), ref: 00F107A2
                                                        • RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 00F107BE
                                                        • RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 00F107DA
                                                        • RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00F10804
                                                        • CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 00F1082C
                                                        • RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00F10837
                                                        • RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00F1083C
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
                                                        • String ID: SOFTWARE\Classes\$\CLSID$\IPC$
                                                        • API String ID: 323675364-22481851
                                                        • Opcode ID: 08132cafd931a34b13494e1757a4c2852690a02b76cf2547a8e37a918eb22b33
                                                        • Instruction ID: 593818122560aa344f7614d0ee39d3dac22590365bddfe941c73cd6c128f50a8
                                                        • Opcode Fuzzy Hash: 08132cafd931a34b13494e1757a4c2852690a02b76cf2547a8e37a918eb22b33
                                                        • Instruction Fuzzy Hash: AE413872C00229ABDF15EBA4DC85CEEB7B8FF14750B04512AE901B71A1EB709E84DB90
                                                        Function 00F43F98 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 00F4403B
                                                        • CreateCompatibleDC.GDI32(00000000), ref: 00F44042
                                                        • SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00F44055
                                                        • SelectObject.GDI32(00000000,00000000), ref: 00F4405D
                                                        • GetPixel.GDI32(00000000,00000000,00000000), ref: 00F44068
                                                        • DeleteDC.GDI32(00000000), ref: 00F44072
                                                        • GetWindowLongW.USER32(?,000000EC), ref: 00F4407C
                                                        • SetLayeredWindowAttributes.USER32(?,?,00000000,00000001,?,00000000,?), ref: 00F44092
                                                        • DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?), ref: 00F4409E
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
                                                        • String ID: static
                                                        • API String ID: 2559357485-2160076837
                                                        • Opcode ID: d4795da5613ba4cdfbe1084509108460e14649ef1f748741444ed4b9500fbe28
                                                        • Instruction ID: 47a162d76a8d2e0666b0234b41fb585a87b4184510b7b98c373a88c0cfec8faa
                                                        • Opcode Fuzzy Hash: d4795da5613ba4cdfbe1084509108460e14649ef1f748741444ed4b9500fbe28
                                                        • Instruction Fuzzy Hash: 03317C36501219ABDF219FA8CC09FDA3F68EF1E320F011211FE18E61A0C775D861EBA4
                                                        Function 00F33C30 Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • VariantInit.OLEAUT32(?), ref: 00F33C5C
                                                        • CoInitialize.OLE32(00000000), ref: 00F33C8A
                                                        • CoUninitialize.OLE32 ref: 00F33C94
                                                        • _wcslen.LIBCMT ref: 00F33D2D
                                                        • GetRunningObjectTable.OLE32(00000000,?), ref: 00F33DB1
                                                        • SetErrorMode.KERNEL32(00000001,00000029), ref: 00F33ED5
                                                        • CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 00F33F0E
                                                        • CoGetObject.OLE32(?,00000000,00F4FB98,?), ref: 00F33F2D
                                                        • SetErrorMode.KERNEL32(00000000), ref: 00F33F40
                                                        • SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00F33FC4
                                                        • VariantClear.OLEAUT32(?), ref: 00F33FD8
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
                                                        • String ID:
                                                        • API String ID: 429561992-0
                                                        • Opcode ID: 89a971229116e244f1b98627ec3d088287182b6cc61da19dfda01cdc621d5919
                                                        • Instruction ID: 927fbd4164343522d21b903ead4952e4aa69ab41a037f5c759e32017faf92b30
                                                        • Opcode Fuzzy Hash: 89a971229116e244f1b98627ec3d088287182b6cc61da19dfda01cdc621d5919
                                                        • Instruction Fuzzy Hash: E2C168716083059FD700DF68C88492BBBE9FF89764F00491DF98A9B261DB31EE45DB92
                                                        Function 00F27A96 Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CoInitialize.OLE32(00000000), ref: 00F27AF3
                                                        • SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00F27B8F
                                                        • SHGetDesktopFolder.SHELL32(?), ref: 00F27BA3
                                                        • CoCreateInstance.OLE32(00F4FD08,00000000,00000001,00F76E6C,?), ref: 00F27BEF
                                                        • SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00F27C74
                                                        • CoTaskMemFree.OLE32(?,?), ref: 00F27CCC
                                                        • SHBrowseForFolderW.SHELL32(?), ref: 00F27D57
                                                        • SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00F27D7A
                                                        • CoTaskMemFree.OLE32(00000000), ref: 00F27D81
                                                        • CoTaskMemFree.OLE32(00000000), ref: 00F27DD6
                                                        • CoUninitialize.OLE32 ref: 00F27DDC
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
                                                        • String ID:
                                                        • API String ID: 2762341140-0
                                                        • Opcode ID: e4dcaaaaa7a3fd051501cdc087c1c3d75d8b1581dec5ea31abf20a64d62c749d
                                                        • Instruction ID: c665c938636f9800a72f0cd8b96501bc7817f8a0bb29b032011f453b0c5612f1
                                                        • Opcode Fuzzy Hash: e4dcaaaaa7a3fd051501cdc087c1c3d75d8b1581dec5ea31abf20a64d62c749d
                                                        • Instruction Fuzzy Hash: 81C14C75A04219AFCB14DFA4D884DAEBBF9FF48314B148499E81AEB361D730ED41DB90
                                                        Function 00F4541D Relevance: 16.7, APIs: 11, Instructions: 191windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00F45504
                                                        • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00F45515
                                                        • CharNextW.USER32(00000158), ref: 00F45544
                                                        • SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00F45585
                                                        • SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00F4559B
                                                        • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00F455AC
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: MessageSend$CharNext
                                                        • String ID:
                                                        • API String ID: 1350042424-0
                                                        • Opcode ID: b835d0435e3a8dc44c6857236356540db40ef665d600e0ff3bee94e1266bf8aa
                                                        • Instruction ID: 283b97a2b56c4ad3068ff9821c4927a2e3ffaea1dba9a21fe8f44012dea94447
                                                        • Opcode Fuzzy Hash: b835d0435e3a8dc44c6857236356540db40ef665d600e0ff3bee94e1266bf8aa
                                                        • Instruction Fuzzy Hash: E6618235905608ABDF10EF54CC84AFE7F79EB06B34F148145FD25AA2A2D7748A81EB60
                                                        Function 00F0FA88 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00F0FAAF
                                                        • SafeArrayAllocData.OLEAUT32(?), ref: 00F0FB08
                                                        • VariantInit.OLEAUT32(?), ref: 00F0FB1A
                                                        • SafeArrayAccessData.OLEAUT32(?,?), ref: 00F0FB3A
                                                        • VariantCopy.OLEAUT32(?,?), ref: 00F0FB8D
                                                        • SafeArrayUnaccessData.OLEAUT32(?), ref: 00F0FBA1
                                                        • VariantClear.OLEAUT32(?), ref: 00F0FBB6
                                                        • SafeArrayDestroyData.OLEAUT32(?), ref: 00F0FBC3
                                                        • SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00F0FBCC
                                                        • VariantClear.OLEAUT32(?), ref: 00F0FBDE
                                                        • SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00F0FBE9
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
                                                        • String ID:
                                                        • API String ID: 2706829360-0
                                                        • Opcode ID: 49dbe51a1931c3d91e39b136512881730ca4a5d41ec361d06189ecf9a97cbafd
                                                        • Instruction ID: 49425d280322c5c20a51e3e935d4ed62ef9ac4f91790c6b274f65d38e4034308
                                                        • Opcode Fuzzy Hash: 49dbe51a1931c3d91e39b136512881730ca4a5d41ec361d06189ecf9a97cbafd
                                                        • Instruction Fuzzy Hash: 71417F75A00219DFCB10DF64CC549AEBBB9FF58354F009069E906A72A1CB34A945EFA0
                                                        Function 00F19C79 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetKeyboardState.USER32(?), ref: 00F19CA1
                                                        • GetAsyncKeyState.USER32(000000A0), ref: 00F19D22
                                                        • GetKeyState.USER32(000000A0), ref: 00F19D3D
                                                        • GetAsyncKeyState.USER32(000000A1), ref: 00F19D57
                                                        • GetKeyState.USER32(000000A1), ref: 00F19D6C
                                                        • GetAsyncKeyState.USER32(00000011), ref: 00F19D84
                                                        • GetKeyState.USER32(00000011), ref: 00F19D96
                                                        • GetAsyncKeyState.USER32(00000012), ref: 00F19DAE
                                                        • GetKeyState.USER32(00000012), ref: 00F19DC0
                                                        • GetAsyncKeyState.USER32(0000005B), ref: 00F19DD8
                                                        • GetKeyState.USER32(0000005B), ref: 00F19DEA
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: State$Async$Keyboard
                                                        • String ID:
                                                        • API String ID: 541375521-0
                                                        • Opcode ID: aa2a65e493c0e3db066a9f30e6875bc2f98f30135743e9f67ffa187be3cd7cfb
                                                        • Instruction ID: fe750e54613f610b88430a3f6256dcd85abd3f87069abe8064a6c974104297f7
                                                        • Opcode Fuzzy Hash: aa2a65e493c0e3db066a9f30e6875bc2f98f30135743e9f67ffa187be3cd7cfb
                                                        • Instruction Fuzzy Hash: BB41EA34E0C7CA69FF308760D4243F5BEE06B22324F08805AD9C6565C2EBE599C4E7E2
                                                        Function 00F3055B Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • WSAStartup.WSOCK32(00000101,?), ref: 00F305BC
                                                        • inet_addr.WSOCK32(?), ref: 00F3061C
                                                        • gethostbyname.WSOCK32(?), ref: 00F30628
                                                        • IcmpCreateFile.IPHLPAPI ref: 00F30636
                                                        • IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00F306C6
                                                        • IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00F306E5
                                                        • IcmpCloseHandle.IPHLPAPI(?), ref: 00F307B9
                                                        • WSACleanup.WSOCK32 ref: 00F307BF
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
                                                        • String ID: Ping
                                                        • API String ID: 1028309954-2246546115
                                                        • Opcode ID: 2da76c710b98dcc7a356c02165140d7377cec024e7104ea151952eaf34045e6e
                                                        • Instruction ID: e13cf098e9226c4d83a3ab8432c13badc28e208d2f2a23eee96c9ced1f2fbc15
                                                        • Opcode Fuzzy Hash: 2da76c710b98dcc7a356c02165140d7377cec024e7104ea151952eaf34045e6e
                                                        • Instruction Fuzzy Hash: 2A919F35A042019FD720DF15C499F1ABBE4AF84328F1485AAF46A9B7A2CB30ED45DFD1
                                                        Function 00F38CD3 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: _wcslen$BuffCharLower
                                                        • String ID: cdecl$none$stdcall$winapi
                                                        • API String ID: 707087890-567219261
                                                        • Opcode ID: c5cf40ce26817b5c5f5c07441b60b40035f8db56a2e1dcf518c2fd9687377c27
                                                        • Instruction ID: d0714583a908e4e3cb043c469917ec2b7a8c644f9a4144de3f9c0f8f978d3a02
                                                        • Opcode Fuzzy Hash: c5cf40ce26817b5c5f5c07441b60b40035f8db56a2e1dcf518c2fd9687377c27
                                                        • Instruction Fuzzy Hash: 0A519431A002169BCF14DFA8C9509BEB7A5BF64770F244229F426E72C5DB38DD42E790
                                                        Function 00F3372C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CoInitialize.OLE32 ref: 00F33774
                                                        • CoUninitialize.OLE32 ref: 00F3377F
                                                        • CoCreateInstance.OLE32(?,00000000,00000017,00F4FB78,?), ref: 00F337D9
                                                        • IIDFromString.OLE32(?,?), ref: 00F3384C
                                                        • VariantInit.OLEAUT32(?), ref: 00F338E4
                                                        • VariantClear.OLEAUT32(?), ref: 00F33936
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
                                                        • String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
                                                        • API String ID: 636576611-1287834457
                                                        • Opcode ID: 24b81354c9acbcfde7d99bb9cc32bf39e295934d55d06196e3dc62db2850d6b3
                                                        • Instruction ID: 5994acd4f0e567071fa40877770a1ba6cc714e1aa16844defda71d9938721f28
                                                        • Opcode Fuzzy Hash: 24b81354c9acbcfde7d99bb9cc32bf39e295934d55d06196e3dc62db2850d6b3
                                                        • Instruction Fuzzy Hash: F761A276608301AFD310DF54C889F5ABBE4EF49720F10491DF9859B2A1C774EE48EBA2
                                                        Function 00F23388 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 149COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • LoadStringW.USER32(00000066,?,00000FFF,?), ref: 00F233CF
                                                          • Part of subcall function 00EB9CB3: _wcslen.LIBCMT ref: 00EB9CBD
                                                        • LoadStringW.USER32(00000072,?,00000FFF,?), ref: 00F233F0
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: LoadString$_wcslen
                                                        • String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
                                                        • API String ID: 4099089115-3080491070
                                                        • Opcode ID: b5daaaa88d00f91b739f3c296dfa2f1967d0183ab9d17c6d1b934eea40a04075
                                                        • Instruction ID: 478ecec00196f26d523d264b29472585024d7b9afa9a87c0c6eb34ed0bdf7c70
                                                        • Opcode Fuzzy Hash: b5daaaa88d00f91b739f3c296dfa2f1967d0183ab9d17c6d1b934eea40a04075
                                                        • Instruction Fuzzy Hash: 29519072D00219ABDF15EBA0DD42EEEB7B8AF04340F245165F50972052EB396F98EF61
                                                        Function 00F1B5C8 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 142COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: _wcslen$BuffCharUpper
                                                        • String ID: APPEND$EXISTS$KEYS$REMOVE
                                                        • API String ID: 1256254125-769500911
                                                        • Opcode ID: 0c5da36e71518ca9104add00e0f8372bd4b3a0edc186940cffbb6734e5e96493
                                                        • Instruction ID: 14a19f067dadfa1e88eca66760e0ab99237ca769fff1d4d71365e6af094c091c
                                                        • Opcode Fuzzy Hash: 0c5da36e71518ca9104add00e0f8372bd4b3a0edc186940cffbb6734e5e96493
                                                        • Instruction Fuzzy Hash: C441C532E00127DBCB206F7DC9A05FE77A5ABB07A4B24416AE465D7284E731CDC2E790
                                                        Function 00F25393 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 103COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SetErrorMode.KERNEL32(00000001), ref: 00F253A0
                                                        • GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00F25416
                                                        • GetLastError.KERNEL32 ref: 00F25420
                                                        • SetErrorMode.KERNEL32(00000000,READY), ref: 00F254A7
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Error$Mode$DiskFreeLastSpace
                                                        • String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
                                                        • API String ID: 4194297153-14809454
                                                        • Opcode ID: df2f23561f52c998f8937fa8be4de165875dbf249fdd253c95caf8970d6c648e
                                                        • Instruction ID: 5da50d49b73ce9434480f769b51a05838ccf721f05114b93b2b5a2119a3d56ad
                                                        • Opcode Fuzzy Hash: df2f23561f52c998f8937fa8be4de165875dbf249fdd253c95caf8970d6c648e
                                                        • Instruction Fuzzy Hash: E2311035E006149FD710EF68D894BAAFBB4EF05B15F148066E805DB292D731DD82EB91
                                                        Function 00F43C46 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CreateMenu.USER32 ref: 00F43C79
                                                        • SetMenu.USER32(?,00000000), ref: 00F43C88
                                                        • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00F43D10
                                                        • IsMenu.USER32(?), ref: 00F43D24
                                                        • CreatePopupMenu.USER32 ref: 00F43D2E
                                                        • InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00F43D5B
                                                        • DrawMenuBar.USER32 ref: 00F43D63
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Menu$CreateItem$DrawInfoInsertPopup
                                                        • String ID: 0$F
                                                        • API String ID: 161812096-3044882817
                                                        • Opcode ID: 2ea90752967c5da2caf75ce4fe94746548828d45a5a8c15b0491d1c3d266be3b
                                                        • Instruction ID: 292b4a5e1c18b57765915d2207b92f071c79271a5f36b7fae323fa6fa672abe9
                                                        • Opcode Fuzzy Hash: 2ea90752967c5da2caf75ce4fe94746548828d45a5a8c15b0491d1c3d266be3b
                                                        • Instruction Fuzzy Hash: 7D413979A02209AFDB14CF64D884AEE7BB5FF59350F140029FE56A7360D770AA10EF94
                                                        Function 00F11EDF Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EB9CB3: _wcslen.LIBCMT ref: 00EB9CBD
                                                          • Part of subcall function 00F13CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00F13CCA
                                                        • SendMessageW.USER32(?,0000018C,000000FF,00020000), ref: 00F11F64
                                                        • GetDlgCtrlID.USER32 ref: 00F11F6F
                                                        • GetParent.USER32 ref: 00F11F8B
                                                        • SendMessageW.USER32(00000000,?,00000111,?), ref: 00F11F8E
                                                        • GetDlgCtrlID.USER32(?), ref: 00F11F97
                                                        • GetParent.USER32(?), ref: 00F11FAB
                                                        • SendMessageW.USER32(00000000,?,00000111,?), ref: 00F11FAE
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: MessageSend$CtrlParent$ClassName_wcslen
                                                        • String ID: ComboBox$ListBox
                                                        • API String ID: 711023334-1403004172
                                                        • Opcode ID: 7f3713e570b31822726efa937ffc4ce22facaff7abf75dc6d20b6e90a7438ceb
                                                        • Instruction ID: 49dda6545a1ab769821eb3e6ed9352749cc3bb70544da37a5f876c29cb5d72b4
                                                        • Opcode Fuzzy Hash: 7f3713e570b31822726efa937ffc4ce22facaff7abf75dc6d20b6e90a7438ceb
                                                        • Instruction Fuzzy Hash: 1E21F274D00218BBCF04AFA0CC84EFEBBB8EF16310F105105FA6563291DB788949EBA0
                                                        Function 00F11FC0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 77windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EB9CB3: _wcslen.LIBCMT ref: 00EB9CBD
                                                          • Part of subcall function 00F13CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00F13CCA
                                                        • SendMessageW.USER32(?,00000186,00020000,00000000), ref: 00F12043
                                                        • GetDlgCtrlID.USER32 ref: 00F1204E
                                                        • GetParent.USER32 ref: 00F1206A
                                                        • SendMessageW.USER32(00000000,?,00000111,?), ref: 00F1206D
                                                        • GetDlgCtrlID.USER32(?), ref: 00F12076
                                                        • GetParent.USER32(?), ref: 00F1208A
                                                        • SendMessageW.USER32(00000000,?,00000111,?), ref: 00F1208D
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: MessageSend$CtrlParent$ClassName_wcslen
                                                        • String ID: ComboBox$ListBox
                                                        • API String ID: 711023334-1403004172
                                                        • Opcode ID: df39767ea31280d10644a2d30ad6815039dd958e1251345d1abb8ffee7fd596f
                                                        • Instruction ID: 89d01066a0ab857d05b3d271dec875dde0c6094fdece32b686d35b1c1d65cc3e
                                                        • Opcode Fuzzy Hash: df39767ea31280d10644a2d30ad6815039dd958e1251345d1abb8ffee7fd596f
                                                        • Instruction Fuzzy Hash: 2421F675D00218BBCF14AFA0DC85EFEBFB8EF19340F105005F959A71A1DA798954EBA0
                                                        Function 00F43A23 Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00F43A9D
                                                        • SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00F43AA0
                                                        • GetWindowLongW.USER32(?,000000F0), ref: 00F43AC7
                                                        • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00F43AEA
                                                        • SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00F43B62
                                                        • SendMessageW.USER32(?,00001074,00000000,00000007), ref: 00F43BAC
                                                        • SendMessageW.USER32(?,00001057,00000000,00000000), ref: 00F43BC7
                                                        • SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 00F43BE2
                                                        • SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 00F43BF6
                                                        • SendMessageW.USER32(?,00001008,00000000,00000007), ref: 00F43C13
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: MessageSend$LongWindow
                                                        • String ID:
                                                        • API String ID: 312131281-0
                                                        • Opcode ID: b586f9cc7c5ac57c4d60a45223cf66b7bb520458a322a733002dfe07ec937d20
                                                        • Instruction ID: 6031d565507f47cc0b9d3b28dcce96357972824860f2b09ea0f677291a69c94b
                                                        • Opcode Fuzzy Hash: b586f9cc7c5ac57c4d60a45223cf66b7bb520458a322a733002dfe07ec937d20
                                                        • Instruction Fuzzy Hash: 5A614B75900248AFDB10DFA8CC81EEE7BF8EB49710F104199FA15A72A1D774AA45EF50
                                                        Function 00F1B12F Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetCurrentThreadId.KERNEL32 ref: 00F1B151
                                                        • GetForegroundWindow.USER32(00000000,?,?,?,?,?,00F1A1E1,?,00000001), ref: 00F1B165
                                                        • GetWindowThreadProcessId.USER32(00000000), ref: 00F1B16C
                                                        • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00F1A1E1,?,00000001), ref: 00F1B17B
                                                        • GetWindowThreadProcessId.USER32(?,00000000), ref: 00F1B18D
                                                        • AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,00F1A1E1,?,00000001), ref: 00F1B1A6
                                                        • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00F1A1E1,?,00000001), ref: 00F1B1B8
                                                        • AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00F1A1E1,?,00000001), ref: 00F1B1FD
                                                        • AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,00F1A1E1,?,00000001), ref: 00F1B212
                                                        • AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,00F1A1E1,?,00000001), ref: 00F1B21D
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Thread$AttachInput$Window$Process$CurrentForeground
                                                        • String ID:
                                                        • API String ID: 2156557900-0
                                                        • Opcode ID: 3b5ea45229306702c008b47144954c93d028aed0ac0c146ad1556664923a2600
                                                        • Instruction ID: 34f4e88e2aeed01a9612cadea2a87a74c596c5d54c43c60b924f8d80b0ad324f
                                                        • Opcode Fuzzy Hash: 3b5ea45229306702c008b47144954c93d028aed0ac0c146ad1556664923a2600
                                                        • Instruction Fuzzy Hash: 2431C175901208FFDF119F64DC58FFD7BA9BB61725F218004FA04D61A0D7B49A84AF60
                                                        Function 00EE2C80 Relevance: 15.1, APIs: 10, Instructions: 54COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • _free.LIBCMT ref: 00EE2C94
                                                          • Part of subcall function 00EE29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00EED7D1,00000000,00000000,00000000,00000000,?,00EED7F8,00000000,00000007,00000000,?,00EEDBF5,00000000), ref: 00EE29DE
                                                          • Part of subcall function 00EE29C8: GetLastError.KERNEL32(00000000,?,00EED7D1,00000000,00000000,00000000,00000000,?,00EED7F8,00000000,00000007,00000000,?,00EEDBF5,00000000,00000000), ref: 00EE29F0
                                                        • _free.LIBCMT ref: 00EE2CA0
                                                        • _free.LIBCMT ref: 00EE2CAB
                                                        • _free.LIBCMT ref: 00EE2CB6
                                                        • _free.LIBCMT ref: 00EE2CC1
                                                        • _free.LIBCMT ref: 00EE2CCC
                                                        • _free.LIBCMT ref: 00EE2CD7
                                                        • _free.LIBCMT ref: 00EE2CE2
                                                        • _free.LIBCMT ref: 00EE2CED
                                                        • _free.LIBCMT ref: 00EE2CFB
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: _free$ErrorFreeHeapLast
                                                        • String ID:
                                                        • API String ID: 776569668-0
                                                        • Opcode ID: f85291f82b10f9346bd16414e6b9e41616e7e35263a1e4c8ac6e386cb526690c
                                                        • Instruction ID: a1d55fa3438dd2672826bd6f09737f1418bac8bac953f17f5681b30e746977b4
                                                        • Opcode Fuzzy Hash: f85291f82b10f9346bd16414e6b9e41616e7e35263a1e4c8ac6e386cb526690c
                                                        • Instruction Fuzzy Hash: EE11B97650014CBFCB02EF56D842CDD3BA9FF45350F5264A9FA486F222D636EE509B90
                                                        Function 00F27DF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 230COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00F27FAD
                                                        • SetCurrentDirectoryW.KERNEL32(?), ref: 00F27FC1
                                                        • GetFileAttributesW.KERNEL32(?), ref: 00F27FEB
                                                        • SetFileAttributesW.KERNEL32(?,00000000), ref: 00F28005
                                                        • SetCurrentDirectoryW.KERNEL32(?), ref: 00F28017
                                                        • SetCurrentDirectoryW.KERNEL32(?), ref: 00F28060
                                                        • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00F280B0
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: CurrentDirectory$AttributesFile
                                                        • String ID: *.*
                                                        • API String ID: 769691225-438819550
                                                        • Opcode ID: fe91013fd2626e285e6953a59e5b33dbbbc0ec93d0c82e39259fb6933cbd923e
                                                        • Instruction ID: b73fdee2c3a92e052d27626928fa6491ae838cff888caabfe5807e3a33e79a51
                                                        • Opcode Fuzzy Hash: fe91013fd2626e285e6953a59e5b33dbbbc0ec93d0c82e39259fb6933cbd923e
                                                        • Instruction Fuzzy Hash: CD81C2729083559BCB20EF54D840AAEB3E8BF89320F154C5EF885D7250EB74DD45EBA2
                                                        Function 00EB5BEA Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SetWindowLongW.USER32(?,000000EB), ref: 00EB5C7A
                                                          • Part of subcall function 00EB5D0A: GetClientRect.USER32(?,?), ref: 00EB5D30
                                                          • Part of subcall function 00EB5D0A: GetWindowRect.USER32(?,?), ref: 00EB5D71
                                                          • Part of subcall function 00EB5D0A: ScreenToClient.USER32(?,?), ref: 00EB5D99
                                                        • GetDC.USER32 ref: 00EF46F5
                                                        • SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00EF4708
                                                        • SelectObject.GDI32(00000000,00000000), ref: 00EF4716
                                                        • SelectObject.GDI32(00000000,00000000), ref: 00EF472B
                                                        • ReleaseDC.USER32(?,00000000), ref: 00EF4733
                                                        • MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00EF47C4
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
                                                        • String ID: U
                                                        • API String ID: 4009187628-3372436214
                                                        • Opcode ID: 95e2d8738c00b3b89f96b5395552ead7b48a87587db4829d58a3b8f65981e480
                                                        • Instruction ID: ad2cf236d17652160269eef6bfc517e17a6f5b8bf97661d0c05e5b72d3995fbf
                                                        • Opcode Fuzzy Hash: 95e2d8738c00b3b89f96b5395552ead7b48a87587db4829d58a3b8f65981e480
                                                        • Instruction Fuzzy Hash: A971E075400209DFCF219F64C984AFB7BB6FF4A368F14626AEE556A1E6C3318841DF50
                                                        Function 00F2359C Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 150COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 00F235E4
                                                          • Part of subcall function 00EB9CB3: _wcslen.LIBCMT ref: 00EB9CBD
                                                        • LoadStringW.USER32(00F82390,?,00000FFF,?), ref: 00F2360A
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: LoadString$_wcslen
                                                        • String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
                                                        • API String ID: 4099089115-2391861430
                                                        • Opcode ID: 555746b05eccd7259fdaa2da98d33c5b985ff640cc08c233e6db5b136ee9a805
                                                        • Instruction ID: 13299ae8df3e9db715253837ef798277a0cf20ebc28bc7a1ccd5440681ebde9f
                                                        • Opcode Fuzzy Hash: 555746b05eccd7259fdaa2da98d33c5b985ff640cc08c233e6db5b136ee9a805
                                                        • Instruction Fuzzy Hash: 1E516071C04219BBDF15EBA0DC82EEEBBB8AF04300F145125F505721A2DB355B99EFA1
                                                        Function 00F2C253 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00F2C272
                                                        • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00F2C29A
                                                        • HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00F2C2CA
                                                        • GetLastError.KERNEL32 ref: 00F2C322
                                                        • SetEvent.KERNEL32(?), ref: 00F2C336
                                                        • InternetCloseHandle.WININET(00000000), ref: 00F2C341
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
                                                        • String ID:
                                                        • API String ID: 3113390036-3916222277
                                                        • Opcode ID: d65141b80d3c9e41ba984a2e8b788b68c60ba3506ec618255ea182efd6824141
                                                        • Instruction ID: 9e9e5ef900e9706370bb9a17f208cde9d324ef85d8f866551b1d7cef9e0ee3aa
                                                        • Opcode Fuzzy Hash: d65141b80d3c9e41ba984a2e8b788b68c60ba3506ec618255ea182efd6824141
                                                        • Instruction Fuzzy Hash: 87319FB1500618AFD721DF64AC88AAF7BFCEB5A754B10891EF446D3210DB74DD44ABE0
                                                        Function 00F1989B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00EF3AAF,?,?,Bad directive syntax error,00F4CC08,00000000,00000010,?,?,>>>AUTOIT SCRIPT<<<), ref: 00F198BC
                                                        • LoadStringW.USER32(00000000,?,00EF3AAF,?), ref: 00F198C3
                                                          • Part of subcall function 00EB9CB3: _wcslen.LIBCMT ref: 00EB9CBD
                                                        • MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00F19987
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: HandleLoadMessageModuleString_wcslen
                                                        • String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
                                                        • API String ID: 858772685-4153970271
                                                        • Opcode ID: bc0c9a6db46485e4c6252042eb4a9d3f6f63d600305b858bbdb22a8d9037956d
                                                        • Instruction ID: e24b1721b2d70842e4c6a7040a5b7bd8d5fb3aed82f39e1fddeb6d98e1a1c321
                                                        • Opcode Fuzzy Hash: bc0c9a6db46485e4c6252042eb4a9d3f6f63d600305b858bbdb22a8d9037956d
                                                        • Instruction Fuzzy Hash: 8821713280421DBBCF15EF90CC16EEE7BB5BF14300F44546AF519750A2EB719658EB51
                                                        Function 00F1209F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetParent.USER32 ref: 00F120AB
                                                        • GetClassNameW.USER32(00000000,?,00000100), ref: 00F120C0
                                                        • SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00F1214D
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: ClassMessageNameParentSend
                                                        • String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
                                                        • API String ID: 1290815626-3381328864
                                                        • Opcode ID: 1a91cefd5a2a82229e9a9c8007692eafc1582200e9edd39ce91756e905194460
                                                        • Instruction ID: 9f0f60a34cd3dd8cd212a5496b68de0a3a278d8e70fab40040127c4cc7c7375b
                                                        • Opcode Fuzzy Hash: 1a91cefd5a2a82229e9a9c8007692eafc1582200e9edd39ce91756e905194460
                                                        • Instruction Fuzzy Hash: 57113A7BA88706BAF605A264DC06DFA339CCB25724B206017FB08B40E1FBA198927515
                                                        Function 00EECE90 Relevance: 13.7, APIs: 9, Instructions: 209COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: _free$EnvironmentVariable___from_strstr_to_strchr
                                                        • String ID:
                                                        • API String ID: 1282221369-0
                                                        • Opcode ID: e9813a55b44da2478036f4bac39164acfff021d89605b23989ae656d761d883f
                                                        • Instruction ID: 5767f44cb6881a2343e123f731f86e2b10e76d8751c5b3c5e7969ba65d71a306
                                                        • Opcode Fuzzy Hash: e9813a55b44da2478036f4bac39164acfff021d89605b23989ae656d761d883f
                                                        • Instruction Fuzzy Hash: 70614A72B0428CAFDB25AFB69C41AB97BD9EF05324F24616DF944B7382DA319D02C750
                                                        Function 00F450D4 Relevance: 13.7, APIs: 9, Instructions: 162windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SendMessageW.USER32(?,00002001,00000000,00000000), ref: 00F45186
                                                        • ShowWindow.USER32(?,00000000), ref: 00F451C7
                                                        • ShowWindow.USER32(?,00000005,?,00000000), ref: 00F451CD
                                                        • SetFocus.USER32(?,?,00000005,?,00000000), ref: 00F451D1
                                                          • Part of subcall function 00F46FBA: DeleteObject.GDI32(00000000), ref: 00F46FE6
                                                        • GetWindowLongW.USER32(?,000000F0), ref: 00F4520D
                                                        • SetWindowLongW.USER32(?,000000F0,00000000), ref: 00F4521A
                                                        • InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00F4524D
                                                        • SendMessageW.USER32(?,00001001,00000000,000000FE), ref: 00F45287
                                                        • SendMessageW.USER32(?,00001026,00000000,000000FE), ref: 00F45296
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
                                                        • String ID:
                                                        • API String ID: 3210457359-0
                                                        • Opcode ID: e55841941536706df6a07ea9f500f56425d348518738b52976d041eb666dbe87
                                                        • Instruction ID: 0459ed8ec16d21cabe0a0cf75b5593eac1edb7b082922fa86f525bc13e8d032f
                                                        • Opcode Fuzzy Hash: e55841941536706df6a07ea9f500f56425d348518738b52976d041eb666dbe87
                                                        • Instruction Fuzzy Hash: DA518135A41A08BFEF20AF64CC49BD93FA5BB45B21F144112FD25962E2C7B59A80FB41
                                                        Function 00EC8B06 Relevance: 13.7, APIs: 9, Instructions: 155windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 00F06890
                                                        • ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 00F068A9
                                                        • LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00F068B9
                                                        • ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 00F068D1
                                                        • SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00F068F2
                                                        • DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00EC8874,00000000,00000000,00000000,000000FF,00000000), ref: 00F06901
                                                        • SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00F0691E
                                                        • DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00EC8874,00000000,00000000,00000000,000000FF,00000000), ref: 00F0692D
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Icon$DestroyExtractImageLoadMessageSend
                                                        • String ID:
                                                        • API String ID: 1268354404-0
                                                        • Opcode ID: 0ff080e69c44d9dfee03edc40cdada5c543fcdb0958abdc39e66ca6afcfb0bc5
                                                        • Instruction ID: b4196d5c5de0ac35601060b07e1c920781ebf1617ed7bede4813c53a4a1f65ce
                                                        • Opcode Fuzzy Hash: 0ff080e69c44d9dfee03edc40cdada5c543fcdb0958abdc39e66ca6afcfb0bc5
                                                        • Instruction Fuzzy Hash: 19518774A00209AFDB208F24CE55FAA7BB5FB58320F105518F946A72A0DB71ED91EB50
                                                        Function 00F2C143 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00F2C182
                                                        • GetLastError.KERNEL32 ref: 00F2C195
                                                        • SetEvent.KERNEL32(?), ref: 00F2C1A9
                                                          • Part of subcall function 00F2C253: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00F2C272
                                                          • Part of subcall function 00F2C253: GetLastError.KERNEL32 ref: 00F2C322
                                                          • Part of subcall function 00F2C253: SetEvent.KERNEL32(?), ref: 00F2C336
                                                          • Part of subcall function 00F2C253: InternetCloseHandle.WININET(00000000), ref: 00F2C341
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
                                                        • String ID:
                                                        • API String ID: 337547030-0
                                                        • Opcode ID: f2b900c9d1c39b414250dabf46deffe3367dada42929add62d0a88a5a39eb961
                                                        • Instruction ID: 1a24845207dcaa61f8895c18c5b3deccfc27f9e5d94520b984df66f95a0ab3f3
                                                        • Opcode Fuzzy Hash: f2b900c9d1c39b414250dabf46deffe3367dada42929add62d0a88a5a39eb961
                                                        • Instruction Fuzzy Hash: 2631AC75601A15EFDB219FA5EC04A6ABBF8FF29310B00441DF95A83620DB35E810FBE0
                                                        Function 00F125A2 Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00F13A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00F13A57
                                                          • Part of subcall function 00F13A3D: GetCurrentThreadId.KERNEL32 ref: 00F13A5E
                                                          • Part of subcall function 00F13A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00F125B3), ref: 00F13A65
                                                        • MapVirtualKeyW.USER32(00000025,00000000), ref: 00F125BD
                                                        • PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00F125DB
                                                        • Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 00F125DF
                                                        • MapVirtualKeyW.USER32(00000025,00000000), ref: 00F125E9
                                                        • PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00F12601
                                                        • Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 00F12605
                                                        • MapVirtualKeyW.USER32(00000025,00000000), ref: 00F1260F
                                                        • PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00F12623
                                                        • Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 00F12627
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
                                                        • String ID:
                                                        • API String ID: 2014098862-0
                                                        • Opcode ID: d936cfd7d91e06cb51ebdf18cc25fa17d4dd653d0986318b609aa7fc336e556b
                                                        • Instruction ID: 8726a978f48f1430092a2fc900db037875356817f7bc4f200f5c9243fcbe2c02
                                                        • Opcode Fuzzy Hash: d936cfd7d91e06cb51ebdf18cc25fa17d4dd653d0986318b609aa7fc336e556b
                                                        • Instruction Fuzzy Hash: 8601D435391214BBFB1067699C8AF993F59DF9EB12F101001F718AE0D1C9F22484AAA9
                                                        Function 00F11803 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,00F11449,?,?,00000000), ref: 00F1180C
                                                        • HeapAlloc.KERNEL32(00000000,?,00F11449,?,?,00000000), ref: 00F11813
                                                        • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00F11449,?,?,00000000), ref: 00F11828
                                                        • GetCurrentProcess.KERNEL32(?,00000000,?,00F11449,?,?,00000000), ref: 00F11830
                                                        • DuplicateHandle.KERNEL32(00000000,?,00F11449,?,?,00000000), ref: 00F11833
                                                        • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00F11449,?,?,00000000), ref: 00F11843
                                                        • GetCurrentProcess.KERNEL32(00F11449,00000000,?,00F11449,?,?,00000000), ref: 00F1184B
                                                        • DuplicateHandle.KERNEL32(00000000,?,00F11449,?,?,00000000), ref: 00F1184E
                                                        • CreateThread.KERNEL32(00000000,00000000,00F11874,00000000,00000000,00000000), ref: 00F11868
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
                                                        • String ID:
                                                        • API String ID: 1957940570-0
                                                        • Opcode ID: 648f96634fbbe01ebbfb2089ea8e9abd56b618604ad02659f14f5b60aed5eef8
                                                        • Instruction ID: 184c41533739ed49723f72edeaf2c95738de06bbf75714a27ffe1adfd68a3d2f
                                                        • Opcode Fuzzy Hash: 648f96634fbbe01ebbfb2089ea8e9abd56b618604ad02659f14f5b60aed5eef8
                                                        • Instruction Fuzzy Hash: 8A01BF75241308BFE750AFA5DC4DF673B6CEB9AB11F005411FA05DB292C6709800DB60
                                                        Function 00EE3E80 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 305COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: __alldvrm$_strrchr
                                                        • String ID: }}$}}$}}
                                                        • API String ID: 1036877536-1495402609
                                                        • Opcode ID: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
                                                        • Instruction ID: 4cf36b3eaec6f8877bc755d36db5d47ed8bcf14b8cf35c36275444626bc33466
                                                        • Opcode Fuzzy Hash: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
                                                        • Instruction Fuzzy Hash: D9A167B1E003CE9FDB26CF2AC8917AEBBE4EF65354F1451ADE585AB282C2348D41C751
                                                        Function 00F3A0E2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00F1D4DC: CreateToolhelp32Snapshot.KERNEL32 ref: 00F1D501
                                                          • Part of subcall function 00F1D4DC: Process32FirstW.KERNEL32(00000000,?), ref: 00F1D50F
                                                          • Part of subcall function 00F1D4DC: CloseHandle.KERNEL32(00000000), ref: 00F1D5DC
                                                        • OpenProcess.KERNEL32(00000001,00000000,?), ref: 00F3A16D
                                                        • GetLastError.KERNEL32 ref: 00F3A180
                                                        • OpenProcess.KERNEL32(00000001,00000000,?), ref: 00F3A1B3
                                                        • TerminateProcess.KERNEL32(00000000,00000000), ref: 00F3A268
                                                        • GetLastError.KERNEL32(00000000), ref: 00F3A273
                                                        • CloseHandle.KERNEL32(00000000), ref: 00F3A2C4
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
                                                        • String ID: SeDebugPrivilege
                                                        • API String ID: 2533919879-2896544425
                                                        • Opcode ID: 2a21935e8c844e154853396b81332471136966d111bf7ea81d468c47e863ae83
                                                        • Instruction ID: b4ecac458c091f814788264dc6260dfb768c72516addf7588340c97c5c06bdd2
                                                        • Opcode Fuzzy Hash: 2a21935e8c844e154853396b81332471136966d111bf7ea81d468c47e863ae83
                                                        • Instruction Fuzzy Hash: B661C0316082429FD720DF15C894F66BBE1AF54328F18848CE4A68B7A3C776EC45DBD2
                                                        Function 00F43886 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00F43925
                                                        • SendMessageW.USER32(00000000,00001036,00000000,?), ref: 00F4393A
                                                        • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00F43954
                                                        • _wcslen.LIBCMT ref: 00F43999
                                                        • SendMessageW.USER32(?,00001057,00000000,?), ref: 00F439C6
                                                        • SendMessageW.USER32(?,00001061,?,0000000F), ref: 00F439F4
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: MessageSend$Window_wcslen
                                                        • String ID: SysListView32
                                                        • API String ID: 2147712094-78025650
                                                        • Opcode ID: 41b68dbe7a915f636958c43b8a55504cefb9c45c293067c26d84b181797e8c83
                                                        • Instruction ID: b1ffc7010a9d6e49816be8fdbe37e990fbf4cbac25479d087a44776ab6daf12b
                                                        • Opcode Fuzzy Hash: 41b68dbe7a915f636958c43b8a55504cefb9c45c293067c26d84b181797e8c83
                                                        • Instruction Fuzzy Hash: 4C41A272E00219ABEF219F64CC45BEA7BA9FF18360F100526FD58E7281D775DA80DB90
                                                        Function 00F1BC5E Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00F1BCFD
                                                        • IsMenu.USER32(00000000), ref: 00F1BD1D
                                                        • CreatePopupMenu.USER32 ref: 00F1BD53
                                                        • GetMenuItemCount.USER32(010355C8), ref: 00F1BDA4
                                                        • InsertMenuItemW.USER32(010355C8,?,00000001,00000030), ref: 00F1BDCC
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Menu$Item$CountCreateInfoInsertPopup
                                                        • String ID: 0$2
                                                        • API String ID: 93392585-3793063076
                                                        • Opcode ID: 0f0ecc59983aa4d9aad39c0f282fe0ab66ece7c6bca6831d22ab84610de47969
                                                        • Instruction ID: e042f5dcd33828312b850d0341dd928a9231027a7c805aea92b77ecad12c10a7
                                                        • Opcode Fuzzy Hash: 0f0ecc59983aa4d9aad39c0f282fe0ab66ece7c6bca6831d22ab84610de47969
                                                        • Instruction Fuzzy Hash: 0C51AF70A00209DBDF18CFA9E888BEEBBF4BF59324F14415DE811E7291D7749981EB61
                                                        Function 00ED2D20 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • _ValidateLocalCookies.LIBCMT ref: 00ED2D4B
                                                        • ___except_validate_context_record.LIBVCRUNTIME ref: 00ED2D53
                                                        • _ValidateLocalCookies.LIBCMT ref: 00ED2DE1
                                                        • __IsNonwritableInCurrentImage.LIBCMT ref: 00ED2E0C
                                                        • _ValidateLocalCookies.LIBCMT ref: 00ED2E61
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                                        • String ID: &H$csm
                                                        • API String ID: 1170836740-1242228090
                                                        • Opcode ID: 0074a33a36d96c1c88cb6631e451a7bc3d832a1ab54fb7fc329bcbab87b000e0
                                                        • Instruction ID: 7be49cb2b6d9d8a4508baa3817b100525b458e7abd1c24cae43894755ebead93
                                                        • Opcode Fuzzy Hash: 0074a33a36d96c1c88cb6631e451a7bc3d832a1ab54fb7fc329bcbab87b000e0
                                                        • Instruction Fuzzy Hash: 2D41D334A00208ABCF10DF68C845A9EBBF5FF54328F14915AEA14BB392D731DA02CBD1
                                                        Function 00F1C874 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • LoadIconW.USER32(00000000,00007F03), ref: 00F1C913
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: IconLoad
                                                        • String ID: blank$info$question$stop$warning
                                                        • API String ID: 2457776203-404129466
                                                        • Opcode ID: 86b4bc2a090ae48c03f0e946207d452bda759be3c8b6f864e102a6be1bb9f98f
                                                        • Instruction ID: 5d303cf6627376b78f3fa486c583e5e62d852d58e1c7274a93025bc23036dc3c
                                                        • Opcode Fuzzy Hash: 86b4bc2a090ae48c03f0e946207d452bda759be3c8b6f864e102a6be1bb9f98f
                                                        • Instruction Fuzzy Hash: 02113872AC9706BAA7049B149CC3DEE2BDCCF25774B50102BF504AA2C2EB709D8172E5
                                                        Function 00F1DE27 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 70networkCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
                                                        • String ID: 0.0.0.0
                                                        • API String ID: 642191829-3771769585
                                                        • Opcode ID: fae29448262c1c3790924571df12a4cb825ddc1f6dbf4de3ecc194bf0c13fdd7
                                                        • Instruction ID: 5cf4e34fa36d58f9a3f8ff3426a0e1b0077535f45d140fe0c2e9ce8bd533a8f8
                                                        • Opcode Fuzzy Hash: fae29448262c1c3790924571df12a4cb825ddc1f6dbf4de3ecc194bf0c13fdd7
                                                        • Instruction Fuzzy Hash: FB112971904109AFCB24AB70DC4AEEE77BCDF61721F00116AF905AA191EF75CAC1EB91
                                                        Function 00F49F86 Relevance: 12.3, APIs: 8, Instructions: 260windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EC9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00EC9BB2
                                                        • GetSystemMetrics.USER32(0000000F), ref: 00F49FC7
                                                        • GetSystemMetrics.USER32(0000000F), ref: 00F49FE7
                                                        • MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 00F4A224
                                                        • SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 00F4A242
                                                        • SendMessageW.USER32(00000003,00000469,?,00000000), ref: 00F4A263
                                                        • ShowWindow.USER32(00000003,00000000), ref: 00F4A282
                                                        • InvalidateRect.USER32(?,00000000,00000001), ref: 00F4A2A7
                                                        • DefDlgProcW.USER32(?,00000005,?,?), ref: 00F4A2CA
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
                                                        • String ID:
                                                        • API String ID: 1211466189-0
                                                        • Opcode ID: bfccb03059f75f8e38308f4b5dab15ec98ff062051caeba87aec62a195cf5ee1
                                                        • Instruction ID: 26906381e7ee08919b698c638d77ce22cc8219642b98f3056f3ed26a24edba8b
                                                        • Opcode Fuzzy Hash: bfccb03059f75f8e38308f4b5dab15ec98ff062051caeba87aec62a195cf5ee1
                                                        • Instruction Fuzzy Hash: D9B1CD31A40219EFDF14CF68C9857AE3BB2FF84711F088169EC499F295D771AA40EB51
                                                        Function 00F1ED19 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: _wcslen$LocalTime
                                                        • String ID:
                                                        • API String ID: 952045576-0
                                                        • Opcode ID: d8e4dcea4454a3a877b7873bdbd8bd7bbf6f836db4861459c0b6abb9565d12ba
                                                        • Instruction ID: 53140b8212578ac5cf0a3ece3d845bd7b72f3a61a9f6f542ac83aee5d2222906
                                                        • Opcode Fuzzy Hash: d8e4dcea4454a3a877b7873bdbd8bd7bbf6f836db4861459c0b6abb9565d12ba
                                                        • Instruction Fuzzy Hash: 88418F65C1021866CB11EBB58C8A9CFB7ECEF45710F50A463E918F3261EB34E296C7E5
                                                        Function 00ECF8D8 Relevance: 12.1, APIs: 8, Instructions: 124COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,00F0682C,00000004,00000000,00000000), ref: 00ECF953
                                                        • ShowWindow.USER32(FFFFFFFF,00000006,?,00000000,?,00F0682C,00000004,00000000,00000000), ref: 00F0F3D1
                                                        • ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,00F0682C,00000004,00000000,00000000), ref: 00F0F454
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: ShowWindow
                                                        • String ID:
                                                        • API String ID: 1268545403-0
                                                        • Opcode ID: a3f14784ed868caba44f8523767258348732f6e5bcbffee411ba41ee3e84efc4
                                                        • Instruction ID: c8515263b4646ce641487d62431a6e3acd35ac3de9fb54c6cf01915be9aa2683
                                                        • Opcode Fuzzy Hash: a3f14784ed868caba44f8523767258348732f6e5bcbffee411ba41ee3e84efc4
                                                        • Instruction Fuzzy Hash: 60410B35504740BACF788B68CA88F6A7A936BD6324F14703CE487765A0C637A486E751
                                                        Function 00F42D03 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • DeleteObject.GDI32(00000000), ref: 00F42D1B
                                                        • GetDC.USER32(00000000), ref: 00F42D23
                                                        • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00F42D2E
                                                        • ReleaseDC.USER32(00000000,00000000), ref: 00F42D3A
                                                        • CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00F42D76
                                                        • SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00F42D87
                                                        • MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00F45A65,?,?,000000FF,00000000,?,000000FF,?), ref: 00F42DC2
                                                        • SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00F42DE1
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
                                                        • String ID:
                                                        • API String ID: 3864802216-0
                                                        • Opcode ID: f77174808e8402a84f47c54d392ebd536e2861415258f7794db05e27a63c1d27
                                                        • Instruction ID: 3bb47b7e04df0168a153714e0da69c3b48abfcc48092d92b348d111d95cf5d88
                                                        • Opcode Fuzzy Hash: f77174808e8402a84f47c54d392ebd536e2861415258f7794db05e27a63c1d27
                                                        • Instruction Fuzzy Hash: B0319F76602614BFEB614F54CC89FEB3FA9EF1A721F044065FE08DA291C6759C40D7A0
                                                        Function 00F15622 Relevance: 12.1, APIs: 8, Instructions: 92COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: _memcmp
                                                        • String ID:
                                                        • API String ID: 2931989736-0
                                                        • Opcode ID: 7c11b1f9fe2c40982979634bd3d807759e31355714d3118c0ad870f2237d1196
                                                        • Instruction ID: eccafe12a724c62a340c891a6c12f01c8a79cb4a11c2ab6556f5f6fb667786aa
                                                        • Opcode Fuzzy Hash: 7c11b1f9fe2c40982979634bd3d807759e31355714d3118c0ad870f2237d1196
                                                        • Instruction Fuzzy Hash: AF210B62B40A09FBD21455208DC2FFB339CEFA1B94F440031FD09AA682F761EE55E5E6
                                                        Function 00F34FAE Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: NULL Pointer assignment$Not an Object type
                                                        • API String ID: 0-572801152
                                                        • Opcode ID: da876bb5887c9d340f7a984a83fe222bf4e8a9e653720be9057f8765b613734e
                                                        • Instruction ID: eebbd2a83c3cefacbe8c2774ecdce1d54ee439abca5bd849cbbcf73e726e9991
                                                        • Opcode Fuzzy Hash: da876bb5887c9d340f7a984a83fe222bf4e8a9e653720be9057f8765b613734e
                                                        • Instruction Fuzzy Hash: 5DD1D2B1E0060A9FDF14DFA8C880BAEB7B5FF88764F148069E915AB280D771DD45DB90
                                                        Function 00EF1522 Relevance: 10.8, APIs: 7, Instructions: 268COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetCPInfo.KERNEL32(?,?), ref: 00EF15CE
                                                        • MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00EF1651
                                                        • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00EF16E4
                                                        • MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00EF16FB
                                                          • Part of subcall function 00EE3820: RtlAllocateHeap.NTDLL(00000000,?,00F81444,?,00ECFDF5,?,?,00EBA976,00000010,00F81440,00EB13FC,?,00EB13C6,?,00EB1129), ref: 00EE3852
                                                        • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00EF1777
                                                        • __freea.LIBCMT ref: 00EF17A2
                                                        • __freea.LIBCMT ref: 00EF17AE
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
                                                        • String ID:
                                                        • API String ID: 2829977744-0
                                                        • Opcode ID: 7f1c054df3e148a0f8881adafa6a03fd36bf8372d4517dda441d07c7654284ea
                                                        • Instruction ID: a9b48f2dfad0bf50cb7c0404842f7951aa1d2a0368f9a109a8e4b0ef37566a60
                                                        • Opcode Fuzzy Hash: 7f1c054df3e148a0f8881adafa6a03fd36bf8372d4517dda441d07c7654284ea
                                                        • Instruction Fuzzy Hash: BC91C371E0021EDADB209E75C881AFE7BF5AF49314F18669AEA05F7191DB35DC40CBA0
                                                        Function 00F34523 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Variant$ClearInit
                                                        • String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
                                                        • API String ID: 2610073882-625585964
                                                        • Opcode ID: af8c8cf68ccadf22fd59c4bb72c6e42f4bc6ffeaa2fd04ef1663251c50fe9176
                                                        • Instruction ID: 1794ab6ecc1f99c43e0a1468294a3a775f991de2105ea68a8528268608b3d539
                                                        • Opcode Fuzzy Hash: af8c8cf68ccadf22fd59c4bb72c6e42f4bc6ffeaa2fd04ef1663251c50fe9176
                                                        • Instruction Fuzzy Hash: 6F918F71E00219ABDF20CFA5C885FAEBBB8EF46720F108559F505AB291D770B945DFA0
                                                        Function 00F21187 Relevance: 10.8, APIs: 7, Instructions: 254COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SafeArrayGetVartype.OLEAUT32(00000001,?), ref: 00F2125C
                                                        • SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00F21284
                                                        • SafeArrayUnaccessData.OLEAUT32(00000001), ref: 00F212A8
                                                        • SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00F212D8
                                                        • SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00F2135F
                                                        • SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00F213C4
                                                        • SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00F21430
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: ArraySafe$Data$Access$UnaccessVartype
                                                        • String ID:
                                                        • API String ID: 2550207440-0
                                                        • Opcode ID: 457840d3edb9b8f2147a00327540bdabf3e8bddbf8f9aa7ac07a6d679fa2add2
                                                        • Instruction ID: e0d8b585571918f4998697765811f3c8f5c0b703d3841410bf0eb4354eb6b6e7
                                                        • Opcode Fuzzy Hash: 457840d3edb9b8f2147a00327540bdabf3e8bddbf8f9aa7ac07a6d679fa2add2
                                                        • Instruction Fuzzy Hash: 7591F476E002289FDB00DFA8E884BBE77B5FF55324F104129E940EB291D778AD41EB94
                                                        Function 00EC948A Relevance: 10.8, APIs: 7, Instructions: 254COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: ObjectSelect$BeginCreatePath
                                                        • String ID:
                                                        • API String ID: 3225163088-0
                                                        • Opcode ID: 8c933fcd4c3955ed4662fc81e8301275580e7dec474fc57a89254404ada5346d
                                                        • Instruction ID: 3f5a6838d005e916f82924cb52107d4b8ceb9e25aae47e5378d2a540d7e6a392
                                                        • Opcode Fuzzy Hash: 8c933fcd4c3955ed4662fc81e8301275580e7dec474fc57a89254404ada5346d
                                                        • Instruction Fuzzy Hash: 15913B71D00219EFCB10CFA9CD88AEEBBB8FF49320F145059E915B7291D375A942DB60
                                                        Function 00F33947 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • VariantInit.OLEAUT32(?), ref: 00F3396B
                                                        • CharUpperBuffW.USER32(?,?), ref: 00F33A7A
                                                        • _wcslen.LIBCMT ref: 00F33A8A
                                                        • VariantClear.OLEAUT32(?), ref: 00F33C1F
                                                          • Part of subcall function 00F20CDF: VariantInit.OLEAUT32(00000000), ref: 00F20D1F
                                                          • Part of subcall function 00F20CDF: VariantCopy.OLEAUT32(?,?), ref: 00F20D28
                                                          • Part of subcall function 00F20CDF: VariantClear.OLEAUT32(?), ref: 00F20D34
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
                                                        • String ID: AUTOIT.ERROR$Incorrect Parameter format
                                                        • API String ID: 4137639002-1221869570
                                                        • Opcode ID: cf32cd303c197b26b8ef68bbcdfbb61e6d8abeffc3a5d2b0025f94667f68a5cf
                                                        • Instruction ID: 813debfe3817ee458b1c3619ee8bc364468aef10fab0435d2f35827206e2b127
                                                        • Opcode Fuzzy Hash: cf32cd303c197b26b8ef68bbcdfbb61e6d8abeffc3a5d2b0025f94667f68a5cf
                                                        • Instruction Fuzzy Hash: A1919A75A083019FCB04DF24C48196AB7E5FF88324F14882DF88A9B351DB35EE46DB92
                                                        Function 00F34BAD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00F1000E: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,00F0FF41,80070057,?,?,?,00F1035E), ref: 00F1002B
                                                          • Part of subcall function 00F1000E: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00F0FF41,80070057,?,?), ref: 00F10046
                                                          • Part of subcall function 00F1000E: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00F0FF41,80070057,?,?), ref: 00F10054
                                                          • Part of subcall function 00F1000E: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00F0FF41,80070057,?), ref: 00F10064
                                                        • CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 00F34C51
                                                        • _wcslen.LIBCMT ref: 00F34D59
                                                        • CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 00F34DCF
                                                        • CoTaskMemFree.OLE32(?), ref: 00F34DDA
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
                                                        • String ID: NULL Pointer assignment
                                                        • API String ID: 614568839-2785691316
                                                        • Opcode ID: afecacd746d7c65860af6fddd8492ab4c2183efcb6a3aa014cffff17d0677161
                                                        • Instruction ID: f247e17eb998117e77904f578ff6d8352ded229408e8a69b51d8a8df3083e6f2
                                                        • Opcode Fuzzy Hash: afecacd746d7c65860af6fddd8492ab4c2183efcb6a3aa014cffff17d0677161
                                                        • Instruction Fuzzy Hash: A9910671D0021DAFDF14DFA4D891AEEB7B8FF08310F10416AE915B7291DB34AA459FA0
                                                        Function 00F420FD Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetMenu.USER32(?), ref: 00F42183
                                                        • GetMenuItemCount.USER32(00000000), ref: 00F421B5
                                                        • GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00F421DD
                                                        • _wcslen.LIBCMT ref: 00F42213
                                                        • GetMenuItemID.USER32(?,?), ref: 00F4224D
                                                        • GetSubMenu.USER32(?,?), ref: 00F4225B
                                                          • Part of subcall function 00F13A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00F13A57
                                                          • Part of subcall function 00F13A3D: GetCurrentThreadId.KERNEL32 ref: 00F13A5E
                                                          • Part of subcall function 00F13A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00F125B3), ref: 00F13A65
                                                        • PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00F422E3
                                                          • Part of subcall function 00F1E97B: Sleep.KERNEL32 ref: 00F1E9F3
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
                                                        • String ID:
                                                        • API String ID: 4196846111-0
                                                        • Opcode ID: a25df0ac5b49fda406ee63fd5d209081eb42124b457c64df3ab13981e6afad3b
                                                        • Instruction ID: 5876e8e569c121be2167f761ffadaa8da571ecda85bdcc81b9c2630f37274ac6
                                                        • Opcode Fuzzy Hash: a25df0ac5b49fda406ee63fd5d209081eb42124b457c64df3ab13981e6afad3b
                                                        • Instruction Fuzzy Hash: 83718E75E00205AFCB50DF64C881AAEBBF1EF88320F548469F816EB351DB74AE419B90
                                                        Function 00F47E9E Relevance: 10.7, APIs: 7, Instructions: 193windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • IsWindow.USER32(01035708), ref: 00F47F37
                                                        • IsWindowEnabled.USER32(01035708), ref: 00F47F43
                                                        • SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 00F4801E
                                                        • SendMessageW.USER32(01035708,000000B0,?,?), ref: 00F48051
                                                        • IsDlgButtonChecked.USER32(?,?), ref: 00F48089
                                                        • GetWindowLongW.USER32(01035708,000000EC), ref: 00F480AB
                                                        • SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 00F480C3
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: MessageSendWindow$ButtonCheckedEnabledLong
                                                        • String ID:
                                                        • API String ID: 4072528602-0
                                                        • Opcode ID: 54c71f8b87f5c1303a8c6f18338b7d26c9cd38039b372e0c6ac5bafdf4c7af51
                                                        • Instruction ID: 70ecb06355053502c1d6af2bbd946871cd729dac0950f05f155e2893fd997e6a
                                                        • Opcode Fuzzy Hash: 54c71f8b87f5c1303a8c6f18338b7d26c9cd38039b372e0c6ac5bafdf4c7af51
                                                        • Instruction Fuzzy Hash: BA719D34A08344AFEB21AF64CC84FFA7FB9EF09360F14445AED5557261DB31A849EB90
                                                        Function 00F1AEBA Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetParent.USER32(?), ref: 00F1AEF9
                                                        • GetKeyboardState.USER32(?), ref: 00F1AF0E
                                                        • SetKeyboardState.USER32(?), ref: 00F1AF6F
                                                        • PostMessageW.USER32(?,00000101,00000010,?), ref: 00F1AF9D
                                                        • PostMessageW.USER32(?,00000101,00000011,?), ref: 00F1AFBC
                                                        • PostMessageW.USER32(?,00000101,00000012,?), ref: 00F1AFFD
                                                        • PostMessageW.USER32(?,00000101,0000005B,?), ref: 00F1B020
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: MessagePost$KeyboardState$Parent
                                                        • String ID:
                                                        • API String ID: 87235514-0
                                                        • Opcode ID: 220d16ed760730187f0daa7e392896a8b17321d78dfaddb01e5e4497ad18cf2c
                                                        • Instruction ID: 7d2bef1db6e4249a41de1b7cd0b2562e8edc062930b464e4faa02faa787e98b5
                                                        • Opcode Fuzzy Hash: 220d16ed760730187f0daa7e392896a8b17321d78dfaddb01e5e4497ad18cf2c
                                                        • Instruction Fuzzy Hash: 3B51D2A1A057D57DFB3682348C45BFABEA95B06314F088589F1D9458C2C3E8ACC9F761
                                                        Function 00F1ACDA Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetParent.USER32(00000000), ref: 00F1AD19
                                                        • GetKeyboardState.USER32(?), ref: 00F1AD2E
                                                        • SetKeyboardState.USER32(?), ref: 00F1AD8F
                                                        • PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00F1ADBB
                                                        • PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00F1ADD8
                                                        • PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00F1AE17
                                                        • PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00F1AE38
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: MessagePost$KeyboardState$Parent
                                                        • String ID:
                                                        • API String ID: 87235514-0
                                                        • Opcode ID: d4a70d274177fe99bc001e851a69f261ea2b14f45b1be40f07332c7c48e90c90
                                                        • Instruction ID: bf875885a775a33f12470235217066893a10fec8be54f32ae5650d9deb8dc758
                                                        • Opcode Fuzzy Hash: d4a70d274177fe99bc001e851a69f261ea2b14f45b1be40f07332c7c48e90c90
                                                        • Instruction Fuzzy Hash: C551E5A1906BD53DFB3383358C55BFA7EA85B46310F088488E1D9468C3D2A4ECD8F762
                                                        Function 00EE542E Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • GetConsoleCP.KERNEL32(00EF3CD6,?,?,?,?,?,?,?,?,00EE5BA3,?,?,00EF3CD6,?,?), ref: 00EE5470
                                                        • __fassign.LIBCMT ref: 00EE54EB
                                                        • __fassign.LIBCMT ref: 00EE5506
                                                        • WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,00EF3CD6,00000005,00000000,00000000), ref: 00EE552C
                                                        • WriteFile.KERNEL32(?,00EF3CD6,00000000,00EE5BA3,00000000,?,?,?,?,?,?,?,?,?,00EE5BA3,?), ref: 00EE554B
                                                        • WriteFile.KERNEL32(?,?,00000001,00EE5BA3,00000000,?,?,?,?,?,?,?,?,?,00EE5BA3,?), ref: 00EE5584
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: FileWrite__fassign$ByteCharConsoleMultiWide
                                                        • String ID:
                                                        • API String ID: 1324828854-0
                                                        • Opcode ID: ce8d7de65e5b92229c56c74be13bb724b71d98f6a94b5f64bf961ab6ef95cfc8
                                                        • Instruction ID: 28c999edd342f7b49cb3a12ba83e403705a47c68b0a9fb6339895f74202b3f3e
                                                        • Opcode Fuzzy Hash: ce8d7de65e5b92229c56c74be13bb724b71d98f6a94b5f64bf961ab6ef95cfc8
                                                        • Instruction Fuzzy Hash: C551F072A0068C9FCB10CFA9D845AEEBBF9EF09304F14501AE955F7291D7309A44CF60
                                                        Function 00F310B8 Relevance: 10.6, APIs: 7, Instructions: 110networkCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00F3304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00F3307A
                                                          • Part of subcall function 00F3304E: _wcslen.LIBCMT ref: 00F3309B
                                                        • socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00F31112
                                                        • WSAGetLastError.WSOCK32 ref: 00F31121
                                                        • WSAGetLastError.WSOCK32 ref: 00F311C9
                                                        • closesocket.WSOCK32(00000000), ref: 00F311F9
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: ErrorLast$_wcslenclosesocketinet_addrsocket
                                                        • String ID:
                                                        • API String ID: 2675159561-0
                                                        • Opcode ID: eb626ab9a69bb2cb2eaab9b55624f4c882838213d1ae416e7735745d1990a8df
                                                        • Instruction ID: 4980827cf543d38cae4afc293b1c6960ac4bd7a2adc1ec9d6f40eb1f808d90a2
                                                        • Opcode Fuzzy Hash: eb626ab9a69bb2cb2eaab9b55624f4c882838213d1ae416e7735745d1990a8df
                                                        • Instruction Fuzzy Hash: CD41D035600208AFDB10AF64C885BEABBE9FF45374F148059FD16AB291C774AD41DBE1
                                                        Function 00F1CF00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00F1DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00F1CF22,?), ref: 00F1DDFD
                                                          • Part of subcall function 00F1DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00F1CF22,?), ref: 00F1DE16
                                                        • lstrcmpiW.KERNEL32(?,?), ref: 00F1CF45
                                                        • MoveFileW.KERNEL32(?,?), ref: 00F1CF7F
                                                        • _wcslen.LIBCMT ref: 00F1D005
                                                        • _wcslen.LIBCMT ref: 00F1D01B
                                                        • SHFileOperationW.SHELL32(?), ref: 00F1D061
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
                                                        • String ID: \*.*
                                                        • API String ID: 3164238972-1173974218
                                                        • Opcode ID: ea9bc032dc9208aae9d5f0149747bc857ea99a9863c920062039e68487f8c5f5
                                                        • Instruction ID: 3cdaaa31b5212ed3bbfe1a5a882bec633495eab5c82d67d24b77ae6fac53457e
                                                        • Opcode Fuzzy Hash: ea9bc032dc9208aae9d5f0149747bc857ea99a9863c920062039e68487f8c5f5
                                                        • Instruction Fuzzy Hash: 61415272D4521D9FDF12EFA4DD81ADEB7F9AF18380F1000E6E505EB142EA34A689DB50
                                                        Function 00F42DFD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00F42E1C
                                                        • GetWindowLongW.USER32(?,000000F0), ref: 00F42E4F
                                                        • GetWindowLongW.USER32(?,000000F0), ref: 00F42E84
                                                        • SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00F42EB6
                                                        • SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00F42EE0
                                                        • GetWindowLongW.USER32(?,000000F0), ref: 00F42EF1
                                                        • SetWindowLongW.USER32(?,000000F0,00000000), ref: 00F42F0B
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: LongWindow$MessageSend
                                                        • String ID:
                                                        • API String ID: 2178440468-0
                                                        • Opcode ID: 3004ad03f47614a8ec79ec7fe48da920cd5e705e804028bfe981eabc110f7ac4
                                                        • Instruction ID: e45241ffe97366a3e22b914539603ef5bb3cbe2c30d815fd7d01e65234f445cc
                                                        • Opcode Fuzzy Hash: 3004ad03f47614a8ec79ec7fe48da920cd5e705e804028bfe981eabc110f7ac4
                                                        • Instruction Fuzzy Hash: 78311335A05248AFEB60CF58DC84FA53BE4FB9A720F951164FD148B2B2CB71AC41EB40
                                                        Function 00F17726 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00F17769
                                                        • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00F1778F
                                                        • SysAllocString.OLEAUT32(00000000), ref: 00F17792
                                                        • SysAllocString.OLEAUT32(?), ref: 00F177B0
                                                        • SysFreeString.OLEAUT32(?), ref: 00F177B9
                                                        • StringFromGUID2.OLE32(?,?,00000028), ref: 00F177DE
                                                        • SysAllocString.OLEAUT32(?), ref: 00F177EC
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: String$Alloc$ByteCharMultiWide$FreeFrom
                                                        • String ID:
                                                        • API String ID: 3761583154-0
                                                        • Opcode ID: 5ff7ed12463e4d780cc260b7fb0beeefaabfe465d4e44b5d41c25e51e3458e89
                                                        • Instruction ID: 694f5760fe46ea6d0a398adbbad4897f1dd4df0f3010d7430d3f83b6f41b2a25
                                                        • Opcode Fuzzy Hash: 5ff7ed12463e4d780cc260b7fb0beeefaabfe465d4e44b5d41c25e51e3458e89
                                                        • Instruction Fuzzy Hash: 8521B57A605219AFDB10EFA8CC84DFB73ACEB09374B048025FD19DB2A1D674DC8197A0
                                                        Function 00F177FD Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00F17842
                                                        • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00F17868
                                                        • SysAllocString.OLEAUT32(00000000), ref: 00F1786B
                                                        • SysAllocString.OLEAUT32 ref: 00F1788C
                                                        • SysFreeString.OLEAUT32 ref: 00F17895
                                                        • StringFromGUID2.OLE32(?,?,00000028), ref: 00F178AF
                                                        • SysAllocString.OLEAUT32(?), ref: 00F178BD
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: String$Alloc$ByteCharMultiWide$FreeFrom
                                                        • String ID:
                                                        • API String ID: 3761583154-0
                                                        • Opcode ID: 46f1c1d2d21fdfb1d6a19d83b12aa61a959372b544ce2091f5f7a21167ff84fe
                                                        • Instruction ID: b6cc12aeb033b8ad1e3979b231aef04617bd85a31fed311c4cea2102968b56e1
                                                        • Opcode Fuzzy Hash: 46f1c1d2d21fdfb1d6a19d83b12aa61a959372b544ce2091f5f7a21167ff84fe
                                                        • Instruction Fuzzy Hash: 4A217736605208AFDB10AFA8DC88DEA77FCEB097707208125F915CB2A1D674DC81DB74
                                                        Function 00F204D2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetStdHandle.KERNEL32(0000000C), ref: 00F204F2
                                                        • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00F2052E
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: CreateHandlePipe
                                                        • String ID: nul
                                                        • API String ID: 1424370930-2873401336
                                                        • Opcode ID: ec7da70fa0ad08d08aa3d456c6b4d26f1466f1d9ebfb823e223ecc5853d4fc4e
                                                        • Instruction ID: bc08f633c1da07235aa81b7800ae607d411823cbae5be110ef4232735326cbb3
                                                        • Opcode Fuzzy Hash: ec7da70fa0ad08d08aa3d456c6b4d26f1466f1d9ebfb823e223ecc5853d4fc4e
                                                        • Instruction Fuzzy Hash: 8E218276A003199BDB208F29EC05A5A77F4AF55734F244A19FCA1D62E1DBB09940EF60
                                                        Function 00F205A7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetStdHandle.KERNEL32(000000F6), ref: 00F205C6
                                                        • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00F20601
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: CreateHandlePipe
                                                        • String ID: nul
                                                        • API String ID: 1424370930-2873401336
                                                        • Opcode ID: d9c211a2b26a2416008884fcddf28cefef1a4ee5deb70f41ca8a91b30842f55e
                                                        • Instruction ID: a8eca742e2614ebc1bbc6bb03c6204921b1abff620e9f5ca05447d1856925e32
                                                        • Opcode Fuzzy Hash: d9c211a2b26a2416008884fcddf28cefef1a4ee5deb70f41ca8a91b30842f55e
                                                        • Instruction Fuzzy Hash: 3621B7369003259FDB208F68EC04A5A7BE4BF95730F200A19FCA1E32E1DBB09950EB51
                                                        Function 00F440AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EB600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00EB604C
                                                          • Part of subcall function 00EB600E: GetStockObject.GDI32(00000011), ref: 00EB6060
                                                          • Part of subcall function 00EB600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 00EB606A
                                                        • SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00F44112
                                                        • SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00F4411F
                                                        • SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00F4412A
                                                        • SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00F44139
                                                        • SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00F44145
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: MessageSend$CreateObjectStockWindow
                                                        • String ID: Msctls_Progress32
                                                        • API String ID: 1025951953-3636473452
                                                        • Opcode ID: 216bc21a24eeed9f2fce778f23bfd2354793511ee560041b4e327ba6990859e1
                                                        • Instruction ID: bcafe8fd9bdde6c5f9d527e82b513ae9c29679dbe43662c1ff0cc7daf2efa26d
                                                        • Opcode Fuzzy Hash: 216bc21a24eeed9f2fce778f23bfd2354793511ee560041b4e327ba6990859e1
                                                        • Instruction Fuzzy Hash: 061193B215021D7EFF119E64CC85EE77F5DEF18798F014111BA18A2050C6769C21ABA4
                                                        Function 00EED7DF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EED7A3: _free.LIBCMT ref: 00EED7CC
                                                        • _free.LIBCMT ref: 00EED82D
                                                          • Part of subcall function 00EE29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00EED7D1,00000000,00000000,00000000,00000000,?,00EED7F8,00000000,00000007,00000000,?,00EEDBF5,00000000), ref: 00EE29DE
                                                          • Part of subcall function 00EE29C8: GetLastError.KERNEL32(00000000,?,00EED7D1,00000000,00000000,00000000,00000000,?,00EED7F8,00000000,00000007,00000000,?,00EEDBF5,00000000,00000000), ref: 00EE29F0
                                                        • _free.LIBCMT ref: 00EED838
                                                        • _free.LIBCMT ref: 00EED843
                                                        • _free.LIBCMT ref: 00EED897
                                                        • _free.LIBCMT ref: 00EED8A2
                                                        • _free.LIBCMT ref: 00EED8AD
                                                        • _free.LIBCMT ref: 00EED8B8
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: _free$ErrorFreeHeapLast
                                                        • String ID:
                                                        • API String ID: 776569668-0
                                                        • Opcode ID: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
                                                        • Instruction ID: f2f39e9357a39d156c61f8bda65c0c515d0bec5c29818045fe9fe7670fc28b55
                                                        • Opcode Fuzzy Hash: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
                                                        • Instruction Fuzzy Hash: E1115E71544B8CAAD621BFB2CC47FCB7BDCAF40700F40282AB699B6093DA69B5058760
                                                        Function 00F1DA5A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00F1DA74
                                                        • LoadStringW.USER32(00000000), ref: 00F1DA7B
                                                        • GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00F1DA91
                                                        • LoadStringW.USER32(00000000), ref: 00F1DA98
                                                        • MessageBoxW.USER32(00000000,?,?,00011010), ref: 00F1DADC
                                                        Strings
                                                        • %s (%d) : ==> %s: %s %s, xrefs: 00F1DAB9
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: HandleLoadModuleString$Message
                                                        • String ID: %s (%d) : ==> %s: %s %s
                                                        • API String ID: 4072794657-3128320259
                                                        • Opcode ID: 4daf6eadce9d429191461640f2fdbb5597449eaf10e7f790ac466ed4559833e9
                                                        • Instruction ID: 5a55b08ba641505904bde944d69f32daf7137cef3e90acf509bcd80997432a39
                                                        • Opcode Fuzzy Hash: 4daf6eadce9d429191461640f2fdbb5597449eaf10e7f790ac466ed4559833e9
                                                        • Instruction Fuzzy Hash: E10186F690020C7FE750EBA09D89EE7376CEB09701F405492BB06E2042EA749E845FB5
                                                        Function 00F2096B Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • InterlockedExchange.KERNEL32(0102E2F0,0102E2F0), ref: 00F2097B
                                                        • EnterCriticalSection.KERNEL32(0102E2D0,00000000), ref: 00F2098D
                                                        • TerminateThread.KERNEL32(?,000001F6), ref: 00F2099B
                                                        • WaitForSingleObject.KERNEL32(?,000003E8), ref: 00F209A9
                                                        • CloseHandle.KERNEL32(?), ref: 00F209B8
                                                        • InterlockedExchange.KERNEL32(0102E2F0,000001F6), ref: 00F209C8
                                                        • LeaveCriticalSection.KERNEL32(0102E2D0), ref: 00F209CF
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
                                                        • String ID:
                                                        • API String ID: 3495660284-0
                                                        • Opcode ID: c4f6cf9979276edc3e4b08bb9a1625de103211a573008d3ba2635e29bb8f417a
                                                        • Instruction ID: 838efab786fc9238d29e5825dacc5bcb2da211133e662b966b252283cb9ebca3
                                                        • Opcode Fuzzy Hash: c4f6cf9979276edc3e4b08bb9a1625de103211a573008d3ba2635e29bb8f417a
                                                        • Instruction Fuzzy Hash: 38F08C32543A16BBD7811FA0EE8CBD6BB38FF12702F402021F602908A1CBB09561EFD0
                                                        Function 00EB5D0A Relevance: 9.3, APIs: 6, Instructions: 276COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetClientRect.USER32(?,?), ref: 00EB5D30
                                                        • GetWindowRect.USER32(?,?), ref: 00EB5D71
                                                        • ScreenToClient.USER32(?,?), ref: 00EB5D99
                                                        • GetClientRect.USER32(?,?), ref: 00EB5ED7
                                                        • GetWindowRect.USER32(?,?), ref: 00EB5EF8
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Rect$Client$Window$Screen
                                                        • String ID:
                                                        • API String ID: 1296646539-0
                                                        • Opcode ID: 9bf2fe33f7815b8f5ae801842a0fc49c218c85fb5b72a1235e983d11f7e0dac2
                                                        • Instruction ID: a7ad3bb686ba4c66324b899344ac6f9b357ae64519f156fef2d2baf90355d918
                                                        • Opcode Fuzzy Hash: 9bf2fe33f7815b8f5ae801842a0fc49c218c85fb5b72a1235e983d11f7e0dac2
                                                        • Instruction Fuzzy Hash: 9CB18A75A0068ADBDB14CFA8C4407FAB7F1FF58310F14A41AE9A9E7290D730EA40DB50
                                                        Function 00EE01B7 Relevance: 9.3, APIs: 6, Instructions: 269COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • __allrem.LIBCMT ref: 00EE00BA
                                                        • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00EE00D6
                                                        • __allrem.LIBCMT ref: 00EE00ED
                                                        • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00EE010B
                                                        • __allrem.LIBCMT ref: 00EE0122
                                                        • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00EE0140
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
                                                        • String ID:
                                                        • API String ID: 1992179935-0
                                                        • Opcode ID: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
                                                        • Instruction ID: 21663ee2bf30c805e6bac377ae1d930517f723b1a7699bf22da075824816380d
                                                        • Opcode Fuzzy Hash: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
                                                        • Instruction Fuzzy Hash: 91811672A0074A9BE720DF6ACC41B6B73E9EF41328F24653AF551FA381E7B0D9418790
                                                        Function 00F31D10 Relevance: 9.3, APIs: 6, Instructions: 254networkCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00F33149: select.WSOCK32(00000000,?,00000000,00000000,?,?,?,00000000,?,?,?,00F3101C,00000000,?,?,00000000), ref: 00F33195
                                                        • __WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 00F31DC0
                                                        • #17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00F31DE1
                                                        • WSAGetLastError.WSOCK32 ref: 00F31DF2
                                                        • inet_ntoa.WSOCK32(?), ref: 00F31E8C
                                                        • htons.WSOCK32(?,?,?,?,?), ref: 00F31EDB
                                                        • _strlen.LIBCMT ref: 00F31F35
                                                          • Part of subcall function 00F139E8: _strlen.LIBCMT ref: 00F139F2
                                                          • Part of subcall function 00EB6D9E: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000002,?,?,?,?,00ECCF58,?,?,?), ref: 00EB6DBA
                                                          • Part of subcall function 00EB6D9E: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,?,?,?,00ECCF58,?,?,?), ref: 00EB6DED
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: ByteCharMultiWide_strlen$ErrorLasthtonsinet_ntoaselect
                                                        • String ID:
                                                        • API String ID: 1923757996-0
                                                        • Opcode ID: f65738694b771244080316ffb2bd9d79b8beb3e5e762dfc7f7908857535505bb
                                                        • Instruction ID: a0a9e1ccecc319e0fdd1a2379f69245dc7218d1170d8e1410a193462ca8130fa
                                                        • Opcode Fuzzy Hash: f65738694b771244080316ffb2bd9d79b8beb3e5e762dfc7f7908857535505bb
                                                        • Instruction Fuzzy Hash: D7A1BD31604300AFC324DB24C885F6BBBE5BF85328F54995CF4566B2A2CB71ED46DB92
                                                        Function 00EE61FE Relevance: 9.2, APIs: 6, Instructions: 216COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00ED82D9,00ED82D9,?,?,?,00EE644F,00000001,00000001,?), ref: 00EE6258
                                                        • MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00EE644F,00000001,00000001,?,?,?,?), ref: 00EE62DE
                                                        • WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,?,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00EE63D8
                                                        • __freea.LIBCMT ref: 00EE63E5
                                                          • Part of subcall function 00EE3820: RtlAllocateHeap.NTDLL(00000000,?,00F81444,?,00ECFDF5,?,?,00EBA976,00000010,00F81440,00EB13FC,?,00EB13C6,?,00EB1129), ref: 00EE3852
                                                        • __freea.LIBCMT ref: 00EE63EE
                                                        • __freea.LIBCMT ref: 00EE6413
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: ByteCharMultiWide__freea$AllocateHeap
                                                        • String ID:
                                                        • API String ID: 1414292761-0
                                                        • Opcode ID: 5b7fdd327c80a98669a287dfd38f0ef95b7cbb7d4d23215d41ad04f67ef7d4e1
                                                        • Instruction ID: 17228808ffac8b7d66ce2331d13db8faed9d395a3310dc2828073a7b103a1783
                                                        • Opcode Fuzzy Hash: 5b7fdd327c80a98669a287dfd38f0ef95b7cbb7d4d23215d41ad04f67ef7d4e1
                                                        • Instruction Fuzzy Hash: 3A51177260024AABDB258FA6DC81EBF77A9EBA4794F145229FD05F7190DB34DC40C660
                                                        Function 00F3BBDB Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EB9CB3: _wcslen.LIBCMT ref: 00EB9CBD
                                                          • Part of subcall function 00F3C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00F3B6AE,?,?), ref: 00F3C9B5
                                                          • Part of subcall function 00F3C998: _wcslen.LIBCMT ref: 00F3C9F1
                                                          • Part of subcall function 00F3C998: _wcslen.LIBCMT ref: 00F3CA68
                                                          • Part of subcall function 00F3C998: _wcslen.LIBCMT ref: 00F3CA9E
                                                        • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00F3BCCA
                                                        • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00F3BD25
                                                        • RegCloseKey.ADVAPI32(00000000), ref: 00F3BD6A
                                                        • RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00F3BD99
                                                        • RegCloseKey.ADVAPI32(?,?,00000000), ref: 00F3BDF3
                                                        • RegCloseKey.ADVAPI32(?), ref: 00F3BDFF
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
                                                        • String ID:
                                                        • API String ID: 1120388591-0
                                                        • Opcode ID: 7784d548d612f0f6819fbd86604f19d4e8eb39da3bf26c8578292c9b8cb26816
                                                        • Instruction ID: c44657eb7b198864c7855dd5c65ff49cf26e883576e2c11412ca19f5ac37ea52
                                                        • Opcode Fuzzy Hash: 7784d548d612f0f6819fbd86604f19d4e8eb39da3bf26c8578292c9b8cb26816
                                                        • Instruction Fuzzy Hash: B581D031608241EFC714DF24C891E6ABBE5FF84328F14895CF5598B2A2CB32ED45DB92
                                                        Function 00F0F7AD Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • VariantInit.OLEAUT32(00000035), ref: 00F0F7B9
                                                        • SysAllocString.OLEAUT32(00000001), ref: 00F0F860
                                                        • VariantCopy.OLEAUT32(00F0FA64,00000000), ref: 00F0F889
                                                        • VariantClear.OLEAUT32(00F0FA64), ref: 00F0F8AD
                                                        • VariantCopy.OLEAUT32(00F0FA64,00000000), ref: 00F0F8B1
                                                        • VariantClear.OLEAUT32(?), ref: 00F0F8BB
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Variant$ClearCopy$AllocInitString
                                                        • String ID:
                                                        • API String ID: 3859894641-0
                                                        • Opcode ID: f03b1ec9365ce60c1c25e65622bd64c8bc53643cdee5569dfd9ebc21e2f7e877
                                                        • Instruction ID: 36b9a8367f77192c7506f36dc9503bbc9e4917113b7592b0342046d122ab4029
                                                        • Opcode Fuzzy Hash: f03b1ec9365ce60c1c25e65622bd64c8bc53643cdee5569dfd9ebc21e2f7e877
                                                        • Instruction Fuzzy Hash: 27512831A00300BACF30AB65DC95B69B3E8EF45320F209466E902EF6D1DB748C44F7A6
                                                        Function 00F2910C Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EB7620: _wcslen.LIBCMT ref: 00EB7625
                                                          • Part of subcall function 00EB6B57: _wcslen.LIBCMT ref: 00EB6B6A
                                                        • GetOpenFileNameW.COMDLG32(00000058), ref: 00F294E5
                                                        • _wcslen.LIBCMT ref: 00F29506
                                                        • _wcslen.LIBCMT ref: 00F2952D
                                                        • GetSaveFileNameW.COMDLG32(00000058), ref: 00F29585
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: _wcslen$FileName$OpenSave
                                                        • String ID: X
                                                        • API String ID: 83654149-3081909835
                                                        • Opcode ID: 4d0fdf477a3e8854c6952a1d20f6dfe9f3e1f55f457d138323d669ace8692d49
                                                        • Instruction ID: c3d63ef36f63ec41173782a1cb8c87b2f30af9ff43d9224db4826eb2e0e2a26f
                                                        • Opcode Fuzzy Hash: 4d0fdf477a3e8854c6952a1d20f6dfe9f3e1f55f457d138323d669ace8692d49
                                                        • Instruction Fuzzy Hash: F5E1B331A08310CFD724DF24D881AABB7E5BF85314F14856DF899AB2A2DB71DD05CB92
                                                        Function 00EC920C Relevance: 9.1, APIs: 6, Instructions: 113COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EC9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00EC9BB2
                                                        • BeginPaint.USER32(?,?,?), ref: 00EC9241
                                                        • GetWindowRect.USER32(?,?), ref: 00EC92A5
                                                        • ScreenToClient.USER32(?,?), ref: 00EC92C2
                                                        • SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00EC92D3
                                                        • EndPaint.USER32(?,?,?,?,?), ref: 00EC9321
                                                        • Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00F071EA
                                                          • Part of subcall function 00EC9339: BeginPath.GDI32(00000000), ref: 00EC9357
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: BeginPaintWindow$ClientLongPathRectRectangleScreenViewport
                                                        • String ID:
                                                        • API String ID: 3050599898-0
                                                        • Opcode ID: 47c2cdd2cf13e20c709bc5b1587947d192a19dadf0bdfa5f255ed7de0220f7e3
                                                        • Instruction ID: e921ef3d9f074d128ab88782718dfc138df0a3d742adbf597da974f89721b1d5
                                                        • Opcode Fuzzy Hash: 47c2cdd2cf13e20c709bc5b1587947d192a19dadf0bdfa5f255ed7de0220f7e3
                                                        • Instruction Fuzzy Hash: 0B41AC30505304AFD710DF24DC88FBA7BA8FB56720F14066DF9A4972E2C732A846EB61
                                                        Function 00F207EF Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • InterlockedExchange.KERNEL32(?,000001F5), ref: 00F2080C
                                                        • ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 00F20847
                                                        • EnterCriticalSection.KERNEL32(?), ref: 00F20863
                                                        • LeaveCriticalSection.KERNEL32(?), ref: 00F208DC
                                                        • ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 00F208F3
                                                        • InterlockedExchange.KERNEL32(?,000001F6), ref: 00F20921
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
                                                        • String ID:
                                                        • API String ID: 3368777196-0
                                                        • Opcode ID: f62cb90082671911bbe0fe5dfd4ddbd59cb773bd25a73672c3b8071cd5f634a9
                                                        • Instruction ID: e5f0ae437d59191a66450bc353d3401cddd9cd93ea90598d03b0f17cdbce74b8
                                                        • Opcode Fuzzy Hash: f62cb90082671911bbe0fe5dfd4ddbd59cb773bd25a73672c3b8071cd5f634a9
                                                        • Instruction Fuzzy Hash: 38418D72900209EFDF14AF54DC85AAA77B9FF04310F1440A9ED04AA297DB71DE61EBA4
                                                        Function 00F481DB Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,00F0F3AB,00000000,?,?,00000000,?,00F0682C,00000004,00000000,00000000), ref: 00F4824C
                                                        • EnableWindow.USER32(?,00000000), ref: 00F48272
                                                        • ShowWindow.USER32(FFFFFFFF,00000000), ref: 00F482D1
                                                        • ShowWindow.USER32(?,00000004), ref: 00F482E5
                                                        • EnableWindow.USER32(?,00000001), ref: 00F4830B
                                                        • SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 00F4832F
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Window$Show$Enable$MessageSend
                                                        • String ID:
                                                        • API String ID: 642888154-0
                                                        • Opcode ID: c3458713dc6b94fc05e74716a1d5f8ae8d678e21565f1afb3c8b3c1437a94d80
                                                        • Instruction ID: 158f84bfd4aab71d53024ec50781cafbcf6b5e105f3fcfb3bbfe901873d99acd
                                                        • Opcode Fuzzy Hash: c3458713dc6b94fc05e74716a1d5f8ae8d678e21565f1afb3c8b3c1437a94d80
                                                        • Instruction Fuzzy Hash: 28419434A01648AFDB11CF15CC99BF87FE0BB0A764F185269ED184B262CB71AD43EB50
                                                        Function 00F14C7D Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • IsWindowVisible.USER32(?), ref: 00F14C95
                                                        • SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00F14CB2
                                                        • SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00F14CEA
                                                        • _wcslen.LIBCMT ref: 00F14D08
                                                        • CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00F14D10
                                                        • _wcsstr.LIBVCRUNTIME ref: 00F14D1A
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
                                                        • String ID:
                                                        • API String ID: 72514467-0
                                                        • Opcode ID: fd173ed7bdf00c843e41c80cc80d90576c17e07d1f00f86af89e8174014e53f8
                                                        • Instruction ID: f20b7c975941013f770e4741e3e6ff88975c641be30d9f82c27c83f7082b075d
                                                        • Opcode Fuzzy Hash: fd173ed7bdf00c843e41c80cc80d90576c17e07d1f00f86af89e8174014e53f8
                                                        • Instruction Fuzzy Hash: 7D2149726052047BEB155B35EC09FBB7BDCDF95720F10902DFC09DA192EA71EC41A2A0
                                                        Function 00F2581E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EB3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00EB3A97,?,?,00EB2E7F,?,?,?,00000000), ref: 00EB3AC2
                                                        • _wcslen.LIBCMT ref: 00F2587B
                                                        • CoInitialize.OLE32(00000000), ref: 00F25995
                                                        • CoCreateInstance.OLE32(00F4FCF8,00000000,00000001,00F4FB68,?), ref: 00F259AE
                                                        • CoUninitialize.OLE32 ref: 00F259CC
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
                                                        • String ID: .lnk
                                                        • API String ID: 3172280962-24824748
                                                        • Opcode ID: 9fa76acc7baeeded531a1645a8eea3283bf464a68f95936c6624b55a4deef53a
                                                        • Instruction ID: aaf4fe364a28993b18b30bc520fcf3b2fd7d2e5582aa5863c2f1f665cc874f27
                                                        • Opcode Fuzzy Hash: 9fa76acc7baeeded531a1645a8eea3283bf464a68f95936c6624b55a4deef53a
                                                        • Instruction Fuzzy Hash: 70D17571A087119FC714DF24D480A6ABBE2FF89B20F14885DF889AB361D731EC45DB92
                                                        Function 00F1175D Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00F10FB4: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00F10FCA
                                                          • Part of subcall function 00F10FB4: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00F10FD6
                                                          • Part of subcall function 00F10FB4: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00F10FE5
                                                          • Part of subcall function 00F10FB4: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00F10FEC
                                                          • Part of subcall function 00F10FB4: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00F11002
                                                        • GetLengthSid.ADVAPI32(?,00000000,00F11335), ref: 00F117AE
                                                        • GetProcessHeap.KERNEL32(00000008,00000000), ref: 00F117BA
                                                        • HeapAlloc.KERNEL32(00000000), ref: 00F117C1
                                                        • CopySid.ADVAPI32(00000000,00000000,?), ref: 00F117DA
                                                        • GetProcessHeap.KERNEL32(00000000,00000000,00F11335), ref: 00F117EE
                                                        • HeapFree.KERNEL32(00000000), ref: 00F117F5
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
                                                        • String ID:
                                                        • API String ID: 3008561057-0
                                                        • Opcode ID: 1541592144605ea29332b4fa7f8672b487d2fdb0c5d86d5eaba5308c653ac32f
                                                        • Instruction ID: 734eae2fee5a8453c29ba37444cd6a1165b33e0905a375daa0eb4c8ce91e9383
                                                        • Opcode Fuzzy Hash: 1541592144605ea29332b4fa7f8672b487d2fdb0c5d86d5eaba5308c653ac32f
                                                        • Instruction Fuzzy Hash: B011BE36902209FFDB109FA4CC49BEF7BA9FB42365F104118F94197251C739A980EBA0
                                                        Function 00F114CE Relevance: 9.1, APIs: 6, Instructions: 64processCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00F114FF
                                                        • OpenProcessToken.ADVAPI32(00000000), ref: 00F11506
                                                        • CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00F11515
                                                        • CloseHandle.KERNEL32(00000004), ref: 00F11520
                                                        • CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00F1154F
                                                        • DestroyEnvironmentBlock.USERENV(00000000), ref: 00F11563
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
                                                        • String ID:
                                                        • API String ID: 1413079979-0
                                                        • Opcode ID: ffb864c476d2d4e957a4b9eca1eab751b62eb0e9b6b9662c4383fa92084c6239
                                                        • Instruction ID: 6b66c9c345b14cf93b640fa83fdd1d5118cdf22617c6ea059d0064f805cf42da
                                                        • Opcode Fuzzy Hash: ffb864c476d2d4e957a4b9eca1eab751b62eb0e9b6b9662c4383fa92084c6239
                                                        • Instruction Fuzzy Hash: 6F11297660220DABDF11CF98DD49BDE7BA9FF49754F044015FE05A2160C3758EA0EBA1
                                                        Function 00ED3382 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • GetLastError.KERNEL32(?,?,00ED3379,00ED2FE5), ref: 00ED3390
                                                        • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00ED339E
                                                        • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00ED33B7
                                                        • SetLastError.KERNEL32(00000000,?,00ED3379,00ED2FE5), ref: 00ED3409
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: ErrorLastValue___vcrt_
                                                        • String ID:
                                                        • API String ID: 3852720340-0
                                                        • Opcode ID: 1ee0b629c33d3d322e4590906d4c5653ff1f43e0af3e5b943ead3f8bc2c7462e
                                                        • Instruction ID: da56a2461152e82569ccb31b7d2f12617a5936925ba5bfd9af1cf4b6b2683990
                                                        • Opcode Fuzzy Hash: 1ee0b629c33d3d322e4590906d4c5653ff1f43e0af3e5b943ead3f8bc2c7462e
                                                        • Instruction Fuzzy Hash: D3012432609315BEA6242BB57C8556A3E94EB15379320222FF534F03F0EF128E03A1C6
                                                        Function 00EE2D74 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • GetLastError.KERNEL32(?,?,00EE5686,00EF3CD6,?,00000000,?,00EE5B6A,?,?,?,?,?,00EDE6D1,?,00F78A48), ref: 00EE2D78
                                                        • _free.LIBCMT ref: 00EE2DAB
                                                        • _free.LIBCMT ref: 00EE2DD3
                                                        • SetLastError.KERNEL32(00000000,?,?,?,?,00EDE6D1,?,00F78A48,00000010,00EB4F4A,?,?,00000000,00EF3CD6), ref: 00EE2DE0
                                                        • SetLastError.KERNEL32(00000000,?,?,?,?,00EDE6D1,?,00F78A48,00000010,00EB4F4A,?,?,00000000,00EF3CD6), ref: 00EE2DEC
                                                        • _abort.LIBCMT ref: 00EE2DF2
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: ErrorLast$_free$_abort
                                                        • String ID:
                                                        • API String ID: 3160817290-0
                                                        • Opcode ID: f4e27506a3c92087a551ba963decbbd9f02a038177b9efb9bdc2a3e09017a972
                                                        • Instruction ID: 23c66b58bbd935b82242475be5283223a3651fcdce0d0889cce73e6f407b0aeb
                                                        • Opcode Fuzzy Hash: f4e27506a3c92087a551ba963decbbd9f02a038177b9efb9bdc2a3e09017a972
                                                        • Instruction Fuzzy Hash: 3DF0F93650558C27C2522F777C0AA5A369DABC27A4F31601CFB24F21E2EF2488015161
                                                        Function 00F48A24 Relevance: 9.0, APIs: 6, Instructions: 49COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EC9639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00EC9693
                                                          • Part of subcall function 00EC9639: SelectObject.GDI32(?,00000000), ref: 00EC96A2
                                                          • Part of subcall function 00EC9639: BeginPath.GDI32(?), ref: 00EC96B9
                                                          • Part of subcall function 00EC9639: SelectObject.GDI32(?,00000000), ref: 00EC96E2
                                                        • MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 00F48A4E
                                                        • LineTo.GDI32(?,00000003,00000000), ref: 00F48A62
                                                        • MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 00F48A70
                                                        • LineTo.GDI32(?,00000000,00000003), ref: 00F48A80
                                                        • EndPath.GDI32(?), ref: 00F48A90
                                                        • StrokePath.GDI32(?), ref: 00F48AA0
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Path$LineMoveObjectSelect$BeginCreateStroke
                                                        • String ID:
                                                        • API String ID: 43455801-0
                                                        • Opcode ID: 4f3915a09bc78b77d02b1c4f331ee2ed070898492c7c4a90609ec00a84eb6f82
                                                        • Instruction ID: b13077bd195245f8d0a3785d2616cafc16dc57b1a462939b873fd3e7059168fe
                                                        • Opcode Fuzzy Hash: 4f3915a09bc78b77d02b1c4f331ee2ed070898492c7c4a90609ec00a84eb6f82
                                                        • Instruction Fuzzy Hash: 7111097600114CFFDB129F94DC88EAA7F6CEB09390F048012FE199A1A1C7719D56EBA0
                                                        Function 00F151FD Relevance: 9.0, APIs: 6, Instructions: 49COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetDC.USER32(00000000), ref: 00F15218
                                                        • GetDeviceCaps.GDI32(00000000,00000058), ref: 00F15229
                                                        • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00F15230
                                                        • ReleaseDC.USER32(00000000,00000000), ref: 00F15238
                                                        • MulDiv.KERNEL32(000009EC,?,00000000), ref: 00F1524F
                                                        • MulDiv.KERNEL32(000009EC,00000001,?), ref: 00F15261
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: CapsDevice$Release
                                                        • String ID:
                                                        • API String ID: 1035833867-0
                                                        • Opcode ID: 973d52d72eb8863e993b9c0fc5b6baae479fd0f89df59c54e20d5506614ebcaa
                                                        • Instruction ID: 96325d5d56f03c282128924b7e75b1e8394f526795602ea14b172986feaa599a
                                                        • Opcode Fuzzy Hash: 973d52d72eb8863e993b9c0fc5b6baae479fd0f89df59c54e20d5506614ebcaa
                                                        • Instruction Fuzzy Hash: 7E018F75E01708BBEB109BA59C49A4EBFB8EB99751F044065FE04A7290D6709800DBA0
                                                        Function 00EB1BC3 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • MapVirtualKeyW.USER32(0000005B,00000000), ref: 00EB1BF4
                                                        • MapVirtualKeyW.USER32(00000010,00000000), ref: 00EB1BFC
                                                        • MapVirtualKeyW.USER32(000000A0,00000000), ref: 00EB1C07
                                                        • MapVirtualKeyW.USER32(000000A1,00000000), ref: 00EB1C12
                                                        • MapVirtualKeyW.USER32(00000011,00000000), ref: 00EB1C1A
                                                        • MapVirtualKeyW.USER32(00000012,00000000), ref: 00EB1C22
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Virtual
                                                        • String ID:
                                                        • API String ID: 4278518827-0
                                                        • Opcode ID: da893a3f421a52a24c9f9452ee19e0e64234aefe39a4d5efb34540e9bd01e097
                                                        • Instruction ID: 5bf07fb5ecc28632a948e6ddf339a8e94ae87611108f4fb61c77334bb4460e60
                                                        • Opcode Fuzzy Hash: da893a3f421a52a24c9f9452ee19e0e64234aefe39a4d5efb34540e9bd01e097
                                                        • Instruction Fuzzy Hash: A90167B0902B5ABDE3008F6A8C85B52FFA8FF19354F00411BA15C4BA42C7F5A864CFE5
                                                        Function 00F1EB20 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00F1EB30
                                                        • SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00F1EB46
                                                        • GetWindowThreadProcessId.USER32(?,?), ref: 00F1EB55
                                                        • OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00F1EB64
                                                        • TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00F1EB6E
                                                        • CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00F1EB75
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
                                                        • String ID:
                                                        • API String ID: 839392675-0
                                                        • Opcode ID: 9b310f9398d4aa53102d73e4c5d551fd5e39d3fdd765e26c92feb3c7059467de
                                                        • Instruction ID: fcee2b6868cc52c00d173ea3a0941d1f52ca3fd5c2adac588a50c40822197053
                                                        • Opcode Fuzzy Hash: 9b310f9398d4aa53102d73e4c5d551fd5e39d3fdd765e26c92feb3c7059467de
                                                        • Instruction Fuzzy Hash: 4EF09A7A60215CBBE7205B629C0EEEF3A7CEFDBB11F005158FA01D1190D7A01A01EAF4
                                                        Function 00F07439 Relevance: 9.0, APIs: 6, Instructions: 37windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetClientRect.USER32(?), ref: 00F07452
                                                        • SendMessageW.USER32(?,00001328,00000000,?), ref: 00F07469
                                                        • GetWindowDC.USER32(?), ref: 00F07475
                                                        • GetPixel.GDI32(00000000,?,?), ref: 00F07484
                                                        • ReleaseDC.USER32(?,00000000), ref: 00F07496
                                                        • GetSysColor.USER32(00000005), ref: 00F074B0
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: ClientColorMessagePixelRectReleaseSendWindow
                                                        • String ID:
                                                        • API String ID: 272304278-0
                                                        • Opcode ID: e748274bb636fab33276261af7ca0b8cef651d262105c410a8d3443a344544fc
                                                        • Instruction ID: 0dfc0ae0f829d54253047f221ef3d1fec94ed0dfdb66f0155b07854f95ed3e2d
                                                        • Opcode Fuzzy Hash: e748274bb636fab33276261af7ca0b8cef651d262105c410a8d3443a344544fc
                                                        • Instruction Fuzzy Hash: B6018B36801209EFDB90AF64DC08BEE7BB5FB15321F2551A4FD19A20A1CB312E41BB90
                                                        Function 00F11874 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • WaitForSingleObject.KERNEL32(?,000000FF), ref: 00F1187F
                                                        • UnloadUserProfile.USERENV(?,?), ref: 00F1188B
                                                        • CloseHandle.KERNEL32(?), ref: 00F11894
                                                        • CloseHandle.KERNEL32(?), ref: 00F1189C
                                                        • GetProcessHeap.KERNEL32(00000000,?), ref: 00F118A5
                                                        • HeapFree.KERNEL32(00000000), ref: 00F118AC
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
                                                        • String ID:
                                                        • API String ID: 146765662-0
                                                        • Opcode ID: f918a7497c295df419a5a4b75e4badb3f1b2e6db02ea2baad1d9a5e1c3567611
                                                        • Instruction ID: 4ed6194a7e5a0161e3bd7f5785a170041f9ebff2cebe2ac3feda85eeea188cf9
                                                        • Opcode Fuzzy Hash: f918a7497c295df419a5a4b75e4badb3f1b2e6db02ea2baad1d9a5e1c3567611
                                                        • Instruction Fuzzy Hash: F8E0ED3A105109BBDB415FA2ED0C905BF39FFAA7217109220F62581171CB325420EF90
                                                        Function 00F1C5D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EB7620: _wcslen.LIBCMT ref: 00EB7625
                                                        • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00F1C6EE
                                                        • _wcslen.LIBCMT ref: 00F1C735
                                                        • SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00F1C79C
                                                        • SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00F1C7CA
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: ItemMenu$Info_wcslen$Default
                                                        • String ID: 0
                                                        • API String ID: 1227352736-4108050209
                                                        • Opcode ID: e2bccd27e81e7e47b99596ccc7e61952a6ef7c5ab2f9796b26e2da853b703209
                                                        • Instruction ID: e2b7262e66d14d16673d7aa44b33c93f94022d81cbdc9b9955dd0edc77041d29
                                                        • Opcode Fuzzy Hash: e2bccd27e81e7e47b99596ccc7e61952a6ef7c5ab2f9796b26e2da853b703209
                                                        • Instruction Fuzzy Hash: F451D171A843019BD7149F28C885BFB77E8AF85320F041A2DF995E31D1DBB0D885EB92
                                                        Function 00F3AD64 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • ShellExecuteExW.SHELL32(0000003C), ref: 00F3AEA3
                                                          • Part of subcall function 00EB7620: _wcslen.LIBCMT ref: 00EB7625
                                                        • GetProcessId.KERNEL32(00000000), ref: 00F3AF38
                                                        • CloseHandle.KERNEL32(00000000), ref: 00F3AF67
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: CloseExecuteHandleProcessShell_wcslen
                                                        • String ID: <$@
                                                        • API String ID: 146682121-1426351568
                                                        • Opcode ID: 590e999bcb3bb81f024afa59bddff20551a5f8e21d050670010c4eb2c8a57fef
                                                        • Instruction ID: 5881238183e8b4dd6e74707f2de19c8421555dcf323275ece39c95c752ad1475
                                                        • Opcode Fuzzy Hash: 590e999bcb3bb81f024afa59bddff20551a5f8e21d050670010c4eb2c8a57fef
                                                        • Instruction Fuzzy Hash: E771AE70A00619DFCB14DF65C485A9EBBF1FF08320F048499E896AB7A2C774ED41DB91
                                                        Function 00F1719E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00F17206
                                                        • SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 00F1723C
                                                        • GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 00F1724D
                                                        • SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00F172CF
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: ErrorMode$AddressCreateInstanceProc
                                                        • String ID: DllGetClassObject
                                                        • API String ID: 753597075-1075368562
                                                        • Opcode ID: 30114043f1babe7628bedc5be14eb9870396eb830dea88427a6658a5c3f35607
                                                        • Instruction ID: 80c9f9187b3870473e68fd38c14da037d521efeea8f23111dab88360d88e038b
                                                        • Opcode Fuzzy Hash: 30114043f1babe7628bedc5be14eb9870396eb830dea88427a6658a5c3f35607
                                                        • Instruction Fuzzy Hash: A2417F71A04304EFDB15DF54C884ADA7BB9EF89310F1480A9BD099F24AD7B1D985EFA0
                                                        Function 00F43D7C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00F43E35
                                                        • IsMenu.USER32(?), ref: 00F43E4A
                                                        • InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00F43E92
                                                        • DrawMenuBar.USER32 ref: 00F43EA5
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Menu$Item$DrawInfoInsert
                                                        • String ID: 0
                                                        • API String ID: 3076010158-4108050209
                                                        • Opcode ID: e39517708a28c9ed77a497de64fbdc613666afa6aa6951e2649971381a31c52d
                                                        • Instruction ID: f90ac15fad2d1cb96a4d8786767cce45df94c4252c125a3751444d52d226dc4e
                                                        • Opcode Fuzzy Hash: e39517708a28c9ed77a497de64fbdc613666afa6aa6951e2649971381a31c52d
                                                        • Instruction Fuzzy Hash: E7413875A02209AFDB10DF50D884AEABBB9FF49364F044129ED15A7350D730AE49EF90
                                                        Function 00F11DE2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EB9CB3: _wcslen.LIBCMT ref: 00EB9CBD
                                                          • Part of subcall function 00F13CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00F13CCA
                                                        • SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00F11E66
                                                        • SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00F11E79
                                                        • SendMessageW.USER32(?,00000189,?,00000000), ref: 00F11EA9
                                                          • Part of subcall function 00EB6B57: _wcslen.LIBCMT ref: 00EB6B6A
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: MessageSend$_wcslen$ClassName
                                                        • String ID: ComboBox$ListBox
                                                        • API String ID: 2081771294-1403004172
                                                        • Opcode ID: 19d7b0a2071e70d0fbb0bf982e061fc4e74c71a53d35ea0240ecd07faae16e40
                                                        • Instruction ID: b155aac0c12914b9120a58c3faba573be2277e136444b28dc851a7c4ecd49952
                                                        • Opcode Fuzzy Hash: 19d7b0a2071e70d0fbb0bf982e061fc4e74c71a53d35ea0240ecd07faae16e40
                                                        • Instruction Fuzzy Hash: 16214971A00108BFDB14ABA4DC85DFFB7F8EF41360B105119FD25A31E1DB385949AB60
                                                        Function 00F3C9EA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 91COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: _wcslen
                                                        • String ID: HKEY_LOCAL_MACHINE$HKLM
                                                        • API String ID: 176396367-4004644295
                                                        • Opcode ID: 599030182319360664262d74abac1ffe8c6083b9f86e816af69f06f163816974
                                                        • Instruction ID: 66ac9dfb4629322c59ced9e89e77ffff1b016ef7a81bdf0e1b61e6a418a72fef
                                                        • Opcode Fuzzy Hash: 599030182319360664262d74abac1ffe8c6083b9f86e816af69f06f163816974
                                                        • Instruction Fuzzy Hash: D6318173E0016A4BCF20EF6D99615BE33919BA1770F15402AE845BB345EA79CD41B3E1
                                                        Function 00F42F17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00F42F8D
                                                        • LoadLibraryW.KERNEL32(?), ref: 00F42F94
                                                        • SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00F42FA9
                                                        • DestroyWindow.USER32(?), ref: 00F42FB1
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: MessageSend$DestroyLibraryLoadWindow
                                                        • String ID: SysAnimate32
                                                        • API String ID: 3529120543-1011021900
                                                        • Opcode ID: e3457b95628e6eb03a6f60e86f544b443b00b7180fc4bbcbc85fede7f145f13e
                                                        • Instruction ID: 9583456c6d80397defaeced15d1bd8d69c4587be55fd2acb5c7b5453e6c3f77a
                                                        • Opcode Fuzzy Hash: e3457b95628e6eb03a6f60e86f544b443b00b7180fc4bbcbc85fede7f145f13e
                                                        • Instruction Fuzzy Hash: 2E219A72A00209ABEB604F64DC80EBB3BB9EB69374F904228FD54D6190D771DC95A7A0
                                                        Function 00ED4D6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00ED4D1E,00EE28E9,(,00ED4CBE,00000000,00F788B8,0000000C,00ED4E15,(,00000002), ref: 00ED4D8D
                                                        • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00ED4DA0
                                                        • FreeLibrary.KERNEL32(00000000,?,?,?,00ED4D1E,00EE28E9,(,00ED4CBE,00000000,00F788B8,0000000C,00ED4E15,(,00000002,00000000), ref: 00ED4DC3
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: AddressFreeHandleLibraryModuleProc
                                                        • String ID: CorExitProcess$mscoree.dll
                                                        • API String ID: 4061214504-1276376045
                                                        • Opcode ID: a16bcd72f1c5ce880e9dd83b5fe443cc2debaa1853c7fb567d2226c7f829babb
                                                        • Instruction ID: 824ad941c66144a7759c87572c8cf1fa63a5cce11ddfc045339a4971aec4fdce
                                                        • Opcode Fuzzy Hash: a16bcd72f1c5ce880e9dd83b5fe443cc2debaa1853c7fb567d2226c7f829babb
                                                        • Instruction Fuzzy Hash: 65F0AF34A0120CBBDB109F90DC09BADBFB5EF58716F0000A9FD09A22A0CB319941EAD1
                                                        Function 00EB4E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • LoadLibraryA.KERNEL32(kernel32.dll,?,?,00EB4EDD,?,00F81418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00EB4E9C
                                                        • GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00EB4EAE
                                                        • FreeLibrary.KERNEL32(00000000,?,?,00EB4EDD,?,00F81418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00EB4EC0
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Library$AddressFreeLoadProc
                                                        • String ID: Wow64DisableWow64FsRedirection$kernel32.dll
                                                        • API String ID: 145871493-3689287502
                                                        • Opcode ID: 957c0f233b6296ab1d5107ea63f3f8132ee2b9b8ff98d364d6348fad720114dc
                                                        • Instruction ID: 41f1a28a7be69fcafe2f2806240a2b2abba1cf0f63cc447cb6e1a3726b8b710e
                                                        • Opcode Fuzzy Hash: 957c0f233b6296ab1d5107ea63f3f8132ee2b9b8ff98d364d6348fad720114dc
                                                        • Instruction Fuzzy Hash: 37E0CD79A035225BD27117296C18F9F7954AFD2F667051116FC04F7142DB60CD01A5E2
                                                        Function 00EB4E59 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • LoadLibraryA.KERNEL32(kernel32.dll,?,?,00EF3CDE,?,00F81418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00EB4E62
                                                        • GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00EB4E74
                                                        • FreeLibrary.KERNEL32(00000000,?,?,00EF3CDE,?,00F81418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00EB4E87
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Library$AddressFreeLoadProc
                                                        • String ID: Wow64RevertWow64FsRedirection$kernel32.dll
                                                        • API String ID: 145871493-1355242751
                                                        • Opcode ID: 83d1c15109948f873cfe20e8ede66132989874207356fe1b8c629c34fc691419
                                                        • Instruction ID: f782695824be32d04e65577546d553202fce7cac974d3ec32d2b8f258cbce077
                                                        • Opcode Fuzzy Hash: 83d1c15109948f873cfe20e8ede66132989874207356fe1b8c629c34fc691419
                                                        • Instruction Fuzzy Hash: 98D0C239503A226747631B246C08DCB3B18AFC2B193052111BC04B6155CF20CD01E5E2
                                                        Function 00F22947 Relevance: 7.8, APIs: 5, Instructions: 313fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00F22C05
                                                        • DeleteFileW.KERNEL32(?), ref: 00F22C87
                                                        • CopyFileW.KERNEL32(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00F22C9D
                                                        • DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00F22CAE
                                                        • DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00F22CC0
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: File$Delete$Copy
                                                        • String ID:
                                                        • API String ID: 3226157194-0
                                                        • Opcode ID: 0c79a7c62ef574504544f464f56d519a19ad39fc7c6ba86d067bf70ea5b8a0fd
                                                        • Instruction ID: 639bdd82bc4fb0a3ce3974c37a2b9310de82065cadcf2f5654ad1a869cb8aa85
                                                        • Opcode Fuzzy Hash: 0c79a7c62ef574504544f464f56d519a19ad39fc7c6ba86d067bf70ea5b8a0fd
                                                        • Instruction Fuzzy Hash: B7B15C72D00129ABDF61EFA4DC85EDFB7BDEF49310F0040A6F509E6251EA349A449FA1
                                                        Function 00F3A387 Relevance: 7.8, APIs: 5, Instructions: 256COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetCurrentProcessId.KERNEL32 ref: 00F3A427
                                                        • OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00F3A435
                                                        • GetProcessIoCounters.KERNEL32(00000000,?), ref: 00F3A468
                                                        • CloseHandle.KERNEL32(?), ref: 00F3A63D
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Process$CloseCountersCurrentHandleOpen
                                                        • String ID:
                                                        • API String ID: 3488606520-0
                                                        • Opcode ID: 113e783c6bb896381c628052dfc8a9ac4ac570ba2cfe61308ae47012f11c1d1a
                                                        • Instruction ID: 730473654f0393ad92f9ce0f546f7f4db41850800b99a9f03e358a273e4309f8
                                                        • Opcode Fuzzy Hash: 113e783c6bb896381c628052dfc8a9ac4ac570ba2cfe61308ae47012f11c1d1a
                                                        • Instruction Fuzzy Hash: D6A192716043009FD720DF25C886F2AB7E5AF84724F14985DF99AAB2D2DB71EC418B92
                                                        Function 00F1E3FB Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00F1DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00F1CF22,?), ref: 00F1DDFD
                                                          • Part of subcall function 00F1DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00F1CF22,?), ref: 00F1DE16
                                                          • Part of subcall function 00F1E199: GetFileAttributesW.KERNEL32(?,00F1CF95), ref: 00F1E19A
                                                        • lstrcmpiW.KERNEL32(?,?), ref: 00F1E473
                                                        • MoveFileW.KERNEL32(?,?), ref: 00F1E4AC
                                                        • _wcslen.LIBCMT ref: 00F1E5EB
                                                        • _wcslen.LIBCMT ref: 00F1E603
                                                        • SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 00F1E650
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
                                                        • String ID:
                                                        • API String ID: 3183298772-0
                                                        • Opcode ID: 200da289ba85f71f8fef6e73408a6e7601f1e4879f6e6e3d91da5f94c0ba1294
                                                        • Instruction ID: e5acba0d19afc78b1c07381beb2e6cbf4becaeb47b52a0262824722510d5fec3
                                                        • Opcode Fuzzy Hash: 200da289ba85f71f8fef6e73408a6e7601f1e4879f6e6e3d91da5f94c0ba1294
                                                        • Instruction Fuzzy Hash: C75183B24083459BC724DB90DC819DFB3ECEF85350F10491EFA89D3192EF74A6889B66
                                                        Function 00F3B9C9 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EB9CB3: _wcslen.LIBCMT ref: 00EB9CBD
                                                          • Part of subcall function 00F3C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00F3B6AE,?,?), ref: 00F3C9B5
                                                          • Part of subcall function 00F3C998: _wcslen.LIBCMT ref: 00F3C9F1
                                                          • Part of subcall function 00F3C998: _wcslen.LIBCMT ref: 00F3CA68
                                                          • Part of subcall function 00F3C998: _wcslen.LIBCMT ref: 00F3CA9E
                                                        • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00F3BAA5
                                                        • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00F3BB00
                                                        • RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00F3BB63
                                                        • RegCloseKey.ADVAPI32(?,?), ref: 00F3BBA6
                                                        • RegCloseKey.ADVAPI32(00000000), ref: 00F3BBB3
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
                                                        • String ID:
                                                        • API String ID: 826366716-0
                                                        • Opcode ID: 9e46afee6f29e5d2a5d43fcab5589165fb352ecad1d6fffe6be4d172531a3510
                                                        • Instruction ID: 2264d1ae6c05c203380796a74f444469571537b17ac7d0e5b84278a1fdec2247
                                                        • Opcode Fuzzy Hash: 9e46afee6f29e5d2a5d43fcab5589165fb352ecad1d6fffe6be4d172531a3510
                                                        • Instruction Fuzzy Hash: 7361B031608241EFC714DF14C8A0E6ABBE5FF84328F14956CF5998B2A2CB35ED45DB92
                                                        Function 00F18BB0 Relevance: 7.7, APIs: 5, Instructions: 159COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • VariantInit.OLEAUT32(?), ref: 00F18BCD
                                                        • VariantClear.OLEAUT32 ref: 00F18C3E
                                                        • VariantClear.OLEAUT32 ref: 00F18C9D
                                                        • VariantClear.OLEAUT32(?), ref: 00F18D10
                                                        • VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00F18D3B
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Variant$Clear$ChangeInitType
                                                        • String ID:
                                                        • API String ID: 4136290138-0
                                                        • Opcode ID: 42a86d81958506430b965eb96cdeeb3491d7c19ec08ef46df8edd2b9447fc5c7
                                                        • Instruction ID: 6ea38cb8ff58e2f83ee56edafce56e38fc99715b73f9e430b701a5eaca9e6a1e
                                                        • Opcode Fuzzy Hash: 42a86d81958506430b965eb96cdeeb3491d7c19ec08ef46df8edd2b9447fc5c7
                                                        • Instruction Fuzzy Hash: 485167B5A00219EFCB10CF68D884AAAB7F8FF99350B158559F909DB350E730E952CF90
                                                        Function 00F28AFB Relevance: 7.6, APIs: 5, Instructions: 143COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00F28BAE
                                                        • GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 00F28BDA
                                                        • WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00F28C32
                                                        • WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00F28C57
                                                        • WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00F28C5F
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: PrivateProfile$SectionWrite$String
                                                        • String ID:
                                                        • API String ID: 2832842796-0
                                                        • Opcode ID: 9e14cc36c1497f9c2ff0ce2d37c803311d78e32e06025c64719cf6a43548d5f8
                                                        • Instruction ID: 18c2f706403624ca8d2b95c0de01d651080734c71ff4c15f7a5a05d648ca0829
                                                        • Opcode Fuzzy Hash: 9e14cc36c1497f9c2ff0ce2d37c803311d78e32e06025c64719cf6a43548d5f8
                                                        • Instruction Fuzzy Hash: 0B516C35A012189FCB15DF64C881EAEBBF5FF49314F088458E849AB362CB35ED41DBA0
                                                        Function 00F38EE4 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • LoadLibraryW.KERNEL32(?,00000000,?), ref: 00F38F40
                                                        • GetProcAddress.KERNEL32(00000000,?), ref: 00F38FD0
                                                        • GetProcAddress.KERNEL32(00000000,00000000), ref: 00F38FEC
                                                        • GetProcAddress.KERNEL32(00000000,?), ref: 00F39032
                                                        • FreeLibrary.KERNEL32(00000000), ref: 00F39052
                                                          • Part of subcall function 00ECF6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,00F21043,?,753CE610), ref: 00ECF6E6
                                                          • Part of subcall function 00ECF6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00F0FA64,00000000,00000000,?,?,00F21043,?,753CE610,?,00F0FA64), ref: 00ECF70D
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
                                                        • String ID:
                                                        • API String ID: 666041331-0
                                                        • Opcode ID: 622ffd8e6e1bc20359a53c1ad5c6197c7e693d3a5bd458af0ee87f385511b4cb
                                                        • Instruction ID: ccd2e3b78aa195194d8283a4d2f568c55d6cbe78b0b3243cf10054401675af54
                                                        • Opcode Fuzzy Hash: 622ffd8e6e1bc20359a53c1ad5c6197c7e693d3a5bd458af0ee87f385511b4cb
                                                        • Instruction Fuzzy Hash: 65515C35A05205DFC715DF64C4848AEBBF1FF49324F0480A9E80AAB362DB71ED86DB90
                                                        Function 00F46B76 Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SetWindowLongW.USER32(00000002,000000F0,?), ref: 00F46C33
                                                        • SetWindowLongW.USER32(?,000000EC,?), ref: 00F46C4A
                                                        • SendMessageW.USER32(00000002,00001036,00000000,?), ref: 00F46C73
                                                        • ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,00F2AB79,00000000,00000000), ref: 00F46C98
                                                        • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 00F46CC7
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Window$Long$MessageSendShow
                                                        • String ID:
                                                        • API String ID: 3688381893-0
                                                        • Opcode ID: 058d1abb3a953778f18269edffb825e7a59f5df9a27e777d0deab868061c1a3b
                                                        • Instruction ID: 78523f27f630dd55c91d7f27205b64696f08be7e37b7c360e7ebd1423066ba5c
                                                        • Opcode Fuzzy Hash: 058d1abb3a953778f18269edffb825e7a59f5df9a27e777d0deab868061c1a3b
                                                        • Instruction Fuzzy Hash: 6841C435A04104AFD724CF68CC94FA97FA5EB0B361F150268FE99E72E0C371AD41EA81
                                                        Function 00EE2051 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: _free
                                                        • String ID:
                                                        • API String ID: 269201875-0
                                                        • Opcode ID: 433f3fe1a832058e493883b9ec678e050cb62268d05026ab8759f25b2b9a3b4d
                                                        • Instruction ID: f34654aa4ff5b183cd761f94691bfc3f794ea23467fa74390603d2307db4509f
                                                        • Opcode Fuzzy Hash: 433f3fe1a832058e493883b9ec678e050cb62268d05026ab8759f25b2b9a3b4d
                                                        • Instruction Fuzzy Hash: AA41E232A002089FCB24DF79C881A5EB3E9EF89714F1555ADE615FB392D731AE01CB81
                                                        Function 00EC912D Relevance: 7.6, APIs: 5, Instructions: 121keyboardCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetCursorPos.USER32(?), ref: 00EC9141
                                                        • ScreenToClient.USER32(00000000,?), ref: 00EC915E
                                                        • GetAsyncKeyState.USER32(00000001), ref: 00EC9183
                                                        • GetAsyncKeyState.USER32(00000002), ref: 00EC919D
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: AsyncState$ClientCursorScreen
                                                        • String ID:
                                                        • API String ID: 4210589936-0
                                                        • Opcode ID: 04f53f4adb8fc9d3f5d2228f876dcb8e873bc07095b40ca96049420313f00d83
                                                        • Instruction ID: 1fd23a2efb52e06c2950af035a49701df9a86d642d014b9e5a099c87777f25c0
                                                        • Opcode Fuzzy Hash: 04f53f4adb8fc9d3f5d2228f876dcb8e873bc07095b40ca96049420313f00d83
                                                        • Instruction Fuzzy Hash: 1D41A431A0821AFBDF05AF64C848BEEB774FF05334F244259E825A32E1C7356951EB91
                                                        Function 00F23874 Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetInputState.USER32 ref: 00F238CB
                                                        • TranslateAcceleratorW.USER32(?,00000000,?), ref: 00F23922
                                                        • TranslateMessage.USER32(?), ref: 00F2394B
                                                        • DispatchMessageW.USER32(?), ref: 00F23955
                                                        • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00F23966
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Message$Translate$AcceleratorDispatchInputPeekState
                                                        • String ID:
                                                        • API String ID: 2256411358-0
                                                        • Opcode ID: 912e507015257fc00b8468e8e8e60fea2bded92c82620eb226dd1f3d91bfb38e
                                                        • Instruction ID: 7c38dd8b73d0246f59d930a718571aeefd51ae62c5048f677fda11c0e434415f
                                                        • Opcode Fuzzy Hash: 912e507015257fc00b8468e8e8e60fea2bded92c82620eb226dd1f3d91bfb38e
                                                        • Instruction Fuzzy Hash: BC31F7F1D053699EEB35CB34A809BF637A9EB16310F04056DE452C61A0E3BC96C5FB11
                                                        Function 00F2CF1A Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • InternetQueryDataAvailable.WININET(?,?,00000000,00000000,00000000,?,00000000,?,?,?,00F2C21E,00000000), ref: 00F2CF38
                                                        • InternetReadFile.WININET(?,00000000,?,?), ref: 00F2CF6F
                                                        • GetLastError.KERNEL32(?,00000000,?,?,?,00F2C21E,00000000), ref: 00F2CFB4
                                                        • SetEvent.KERNEL32(?,?,00000000,?,?,?,00F2C21E,00000000), ref: 00F2CFC8
                                                        • SetEvent.KERNEL32(?,?,00000000,?,?,?,00F2C21E,00000000), ref: 00F2CFF2
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: EventInternet$AvailableDataErrorFileLastQueryRead
                                                        • String ID:
                                                        • API String ID: 3191363074-0
                                                        • Opcode ID: 66026789eaed1b0bf63733f095a97881ed028486c267d2692f9e4cddaa9387b3
                                                        • Instruction ID: c3567162bacd756b07522dfa5cfc95eeb9670800b116e6c83754db5081945618
                                                        • Opcode Fuzzy Hash: 66026789eaed1b0bf63733f095a97881ed028486c267d2692f9e4cddaa9387b3
                                                        • Instruction Fuzzy Hash: A6315071900615EFDB20DFA5EA84AAFBBF9EF15360B10442EF516D2150D730AE41EBB0
                                                        Function 00F11901 Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetWindowRect.USER32(?,?), ref: 00F11915
                                                        • PostMessageW.USER32(00000001,00000201,00000001), ref: 00F119C1
                                                        • Sleep.KERNEL32(00000000,?,?,?), ref: 00F119C9
                                                        • PostMessageW.USER32(00000001,00000202,00000000), ref: 00F119DA
                                                        • Sleep.KERNEL32(00000000,?,?,?,?), ref: 00F119E2
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: MessagePostSleep$RectWindow
                                                        • String ID:
                                                        • API String ID: 3382505437-0
                                                        • Opcode ID: e1016d0ef0439da80bf052d204263fca70935affc5cadf02c29f4a5204bc8530
                                                        • Instruction ID: 0bbf1ae20e328f5c1c2b53f5bd8cba500f6b54c67be1ccf7770ce2699993fc12
                                                        • Opcode Fuzzy Hash: e1016d0ef0439da80bf052d204263fca70935affc5cadf02c29f4a5204bc8530
                                                        • Instruction Fuzzy Hash: 7A31D17290021DEFCB00CFA8CD98ADE3BB5FB55324F008225FA21A72D1C3709984EB90
                                                        Function 00F45706 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SendMessageW.USER32(?,00001053,000000FF,?), ref: 00F45745
                                                        • SendMessageW.USER32(?,00001074,?,00000001), ref: 00F4579D
                                                        • _wcslen.LIBCMT ref: 00F457AF
                                                        • _wcslen.LIBCMT ref: 00F457BA
                                                        • SendMessageW.USER32(?,00001002,00000000,?), ref: 00F45816
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: MessageSend$_wcslen
                                                        • String ID:
                                                        • API String ID: 763830540-0
                                                        • Opcode ID: 451a472f957462141e3677c216f8aac012674fd3dfc51515ca45518075ca28f9
                                                        • Instruction ID: 05257314915433b45070edc3695e2c8db64fcfb17bd7f942af981b373d5c4231
                                                        • Opcode Fuzzy Hash: 451a472f957462141e3677c216f8aac012674fd3dfc51515ca45518075ca28f9
                                                        • Instruction Fuzzy Hash: 82219175D046189BDB20EFA0CC85AEE7BB8FF15B20F108226ED29EA191D7708985DF50
                                                        Function 00F30930 Relevance: 7.6, APIs: 5, Instructions: 69COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • IsWindow.USER32(00000000), ref: 00F30951
                                                        • GetForegroundWindow.USER32 ref: 00F30968
                                                        • GetDC.USER32(00000000), ref: 00F309A4
                                                        • GetPixel.GDI32(00000000,?,00000003), ref: 00F309B0
                                                        • ReleaseDC.USER32(00000000,00000003), ref: 00F309E8
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Window$ForegroundPixelRelease
                                                        • String ID:
                                                        • API String ID: 4156661090-0
                                                        • Opcode ID: 3db1479481d2ad842b9ad9fa9146d653f3e9d92c7bd736dcc9dcf6f79f3dfba8
                                                        • Instruction ID: 1f99bc32263b12b1b5780e0a3df042b13f9420540861ece817759386cb6332e5
                                                        • Opcode Fuzzy Hash: 3db1479481d2ad842b9ad9fa9146d653f3e9d92c7bd736dcc9dcf6f79f3dfba8
                                                        • Instruction Fuzzy Hash: 02219F39601218AFD714EF64DC94AAEBBE9FF55710F048069F84AA7362CB70AD04DB90
                                                        Function 00EECDBD Relevance: 7.6, APIs: 5, Instructions: 68COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetEnvironmentStringsW.KERNEL32 ref: 00EECDC6
                                                        • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00EECDE9
                                                          • Part of subcall function 00EE3820: RtlAllocateHeap.NTDLL(00000000,?,00F81444,?,00ECFDF5,?,?,00EBA976,00000010,00F81440,00EB13FC,?,00EB13C6,?,00EB1129), ref: 00EE3852
                                                        • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00EECE0F
                                                        • _free.LIBCMT ref: 00EECE22
                                                        • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00EECE31
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
                                                        • String ID:
                                                        • API String ID: 336800556-0
                                                        • Opcode ID: edcce0228afd5ee44d5b62f2ce80eefcb7bc4408894c201dc3cd7a75c59736b5
                                                        • Instruction ID: 341f58ea82c815109abaa1cb538d3ca5438455176116117bb1c8dccf61b608c3
                                                        • Opcode Fuzzy Hash: edcce0228afd5ee44d5b62f2ce80eefcb7bc4408894c201dc3cd7a75c59736b5
                                                        • Instruction Fuzzy Hash: E501F77260229D7F23251ABB6C8CC7F7A6DDEC7BA53252129FD05E7211EA618D0391F0
                                                        Function 00EC9639 Relevance: 7.6, APIs: 5, Instructions: 66COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00EC9693
                                                        • SelectObject.GDI32(?,00000000), ref: 00EC96A2
                                                        • BeginPath.GDI32(?), ref: 00EC96B9
                                                        • SelectObject.GDI32(?,00000000), ref: 00EC96E2
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: ObjectSelect$BeginCreatePath
                                                        • String ID:
                                                        • API String ID: 3225163088-0
                                                        • Opcode ID: 35107df1b28e33ac4d0f01b3ab65622475828eda755c59dd6ada1fe5ce87a156
                                                        • Instruction ID: a11f0871a804f34cc1774482330521dfb1aa5bcbe172917a611ccd4bbd4eb9d3
                                                        • Opcode Fuzzy Hash: 35107df1b28e33ac4d0f01b3ab65622475828eda755c59dd6ada1fe5ce87a156
                                                        • Instruction Fuzzy Hash: C2218030802309EBDB119F64ED08BF97BA8BB51369F10131AF810B61F1D3719897EB94
                                                        Function 00EC990E Relevance: 7.6, APIs: 5, Instructions: 65COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetSysColor.USER32(00000008), ref: 00EC98CC
                                                        • SetTextColor.GDI32(?,?), ref: 00EC98D6
                                                        • SetBkMode.GDI32(?,00000001), ref: 00EC98E9
                                                        • GetStockObject.GDI32(00000005), ref: 00EC98F1
                                                        • GetWindowLongW.USER32(?,000000EB), ref: 00EC9952
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Color$LongModeObjectStockTextWindow
                                                        • String ID:
                                                        • API String ID: 1860813098-0
                                                        • Opcode ID: b86ddb667b8ae4c629c25e0824cc3c960df46fa2abdd2aad75a316e7e79d1a2f
                                                        • Instruction ID: a62f58a0ba21f6414e673a2df2712d1115de69764fcc2f020323aa5820acf076
                                                        • Opcode Fuzzy Hash: b86ddb667b8ae4c629c25e0824cc3c960df46fa2abdd2aad75a316e7e79d1a2f
                                                        • Instruction Fuzzy Hash: A2216D325462449FDB128F30DC5DFF63F64AB93335B09115DE9A26B1A3C6334942DB90
                                                        Function 00F15711 Relevance: 7.6, APIs: 5, Instructions: 61COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: _memcmp
                                                        • String ID:
                                                        • API String ID: 2931989736-0
                                                        • Opcode ID: a32b37605fbbb18df116869cef5804681d8366761a6d20fae4cde6ccd8b4073d
                                                        • Instruction ID: 5ee858b294d5c4dab33c34a7c579efe56a188f7d90f6e022bcb110f7ea1ca207
                                                        • Opcode Fuzzy Hash: a32b37605fbbb18df116869cef5804681d8366761a6d20fae4cde6ccd8b4073d
                                                        • Instruction Fuzzy Hash: 2201B5A6A4160DFBE20855119D83FFB739CDBA1BA4F004021FD08AE2C2F760ED55A6A1
                                                        Function 00EE2DF8 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • GetLastError.KERNEL32(?,?,?,00EDF2DE,00EE3863,00F81444,?,00ECFDF5,?,?,00EBA976,00000010,00F81440,00EB13FC,?,00EB13C6), ref: 00EE2DFD
                                                        • _free.LIBCMT ref: 00EE2E32
                                                        • _free.LIBCMT ref: 00EE2E59
                                                        • SetLastError.KERNEL32(00000000,00EB1129), ref: 00EE2E66
                                                        • SetLastError.KERNEL32(00000000,00EB1129), ref: 00EE2E6F
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: ErrorLast$_free
                                                        • String ID:
                                                        • API String ID: 3170660625-0
                                                        • Opcode ID: e2d20843eee0a5f9abe111b33421743d0fd87064d142870ae204a51eec4f8c0f
                                                        • Instruction ID: 67ea6cdbaf484fbef92ec82dd874341cdfc4f1bcad22439827e3c4f6c21d5390
                                                        • Opcode Fuzzy Hash: e2d20843eee0a5f9abe111b33421743d0fd87064d142870ae204a51eec4f8c0f
                                                        • Instruction Fuzzy Hash: 9F01493610269C27C6132F773C4AD6B269DABD1768B31702CFA14B31F3EE648C011060
                                                        Function 00F1000E Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,00F0FF41,80070057,?,?,?,00F1035E), ref: 00F1002B
                                                        • ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00F0FF41,80070057,?,?), ref: 00F10046
                                                        • lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00F0FF41,80070057,?,?), ref: 00F10054
                                                        • CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00F0FF41,80070057,?), ref: 00F10064
                                                        • CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00F0FF41,80070057,?,?), ref: 00F10070
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: From$Prog$FreeStringTasklstrcmpi
                                                        • String ID:
                                                        • API String ID: 3897988419-0
                                                        • Opcode ID: 226fc6cb9c489a2015c897c7a2fe68570b8f7d05f91b8a68141e65b1d74ab904
                                                        • Instruction ID: b9ea40e73195753e74a244eb2f8e68f3e7d3d20dc1eb994a154be06330918dd6
                                                        • Opcode Fuzzy Hash: 226fc6cb9c489a2015c897c7a2fe68570b8f7d05f91b8a68141e65b1d74ab904
                                                        • Instruction Fuzzy Hash: B001A776601208BFDB504F64DC04BEA7AEDEF58751F145114FD05D2210EBB5DDC0A7A0
                                                        Function 00F1E97B Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • QueryPerformanceCounter.KERNEL32(?), ref: 00F1E997
                                                        • QueryPerformanceFrequency.KERNEL32(?), ref: 00F1E9A5
                                                        • Sleep.KERNEL32(00000000), ref: 00F1E9AD
                                                        • QueryPerformanceCounter.KERNEL32(?), ref: 00F1E9B7
                                                        • Sleep.KERNEL32 ref: 00F1E9F3
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: PerformanceQuery$CounterSleep$Frequency
                                                        • String ID:
                                                        • API String ID: 2833360925-0
                                                        • Opcode ID: 618f4451ac2af9704180f8390f146c12d5f78d30b42e38749f32bb607b53d038
                                                        • Instruction ID: eddad1853b109c9905dee20653b4edebd8b19f3daf77445e04d549d3d3722f95
                                                        • Opcode Fuzzy Hash: 618f4451ac2af9704180f8390f146c12d5f78d30b42e38749f32bb607b53d038
                                                        • Instruction Fuzzy Hash: 5B015735C0262DDBCF44ABE5D859AEDBB78BB49710F400546E902B2241DB309690ABA1
                                                        Function 00F110F9 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00F11114
                                                        • GetLastError.KERNEL32(?,00000000,00000000,?,?,00F10B9B,?,?,?), ref: 00F11120
                                                        • GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00F10B9B,?,?,?), ref: 00F1112F
                                                        • HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00F10B9B,?,?,?), ref: 00F11136
                                                        • GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00F1114D
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: HeapObjectSecurityUser$AllocErrorLastProcess
                                                        • String ID:
                                                        • API String ID: 842720411-0
                                                        • Opcode ID: 11d287518882cdd5a7043610ff7d184c0209ae13b107d89519edb03157c1ac7f
                                                        • Instruction ID: dc3d891af81d4c79937591fc3e5dfc1b3ee3562bb9453a833bbe2c1bc8e9916f
                                                        • Opcode Fuzzy Hash: 11d287518882cdd5a7043610ff7d184c0209ae13b107d89519edb03157c1ac7f
                                                        • Instruction Fuzzy Hash: 64016D79501209BFDB514FA5DC49AAA3B6EFF86364B110414FE45D3360DA31DC40AEA0
                                                        Function 00F10FB4 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00F10FCA
                                                        • GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00F10FD6
                                                        • GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00F10FE5
                                                        • HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00F10FEC
                                                        • GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00F11002
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: HeapInformationToken$AllocErrorLastProcess
                                                        • String ID:
                                                        • API String ID: 44706859-0
                                                        • Opcode ID: f96fb988fefe5c97580a5ad32e619257a0a924ba655ad485041b889fb05ed0d9
                                                        • Instruction ID: cb2972a4f2d25760d21f0267a761c85f355100b4b50937fc7988dadabc6b8cf5
                                                        • Opcode Fuzzy Hash: f96fb988fefe5c97580a5ad32e619257a0a924ba655ad485041b889fb05ed0d9
                                                        • Instruction Fuzzy Hash: 6AF06239602305EBD7214FA5DC4DF963B6DFF9A761F104414FE45C7251CA71DC809AA0
                                                        Function 00F11014 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00F1102A
                                                        • GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00F11036
                                                        • GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00F11045
                                                        • HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00F1104C
                                                        • GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00F11062
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: HeapInformationToken$AllocErrorLastProcess
                                                        • String ID:
                                                        • API String ID: 44706859-0
                                                        • Opcode ID: a111b8fbd1205461e7693a22540fe5ff0918b53f340e4ec3084fbb2d9978086a
                                                        • Instruction ID: ebbeee6360e0bab183c95b72b727972ad1eed03bada73ac58575f318c9398a80
                                                        • Opcode Fuzzy Hash: a111b8fbd1205461e7693a22540fe5ff0918b53f340e4ec3084fbb2d9978086a
                                                        • Instruction Fuzzy Hash: 41F06D39602309EBDB215FA9EC49F963BADFF9A761F100414FE45C7251CA70D880EAA0
                                                        Function 00F2030F Relevance: 7.5, APIs: 6, Instructions: 41COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CloseHandle.KERNEL32(?,?,?,?,00F2017D,?,00F232FC,?,00000001,00EF2592,?), ref: 00F20324
                                                        • CloseHandle.KERNEL32(?,?,?,?,00F2017D,?,00F232FC,?,00000001,00EF2592,?), ref: 00F20331
                                                        • CloseHandle.KERNEL32(?,?,?,?,00F2017D,?,00F232FC,?,00000001,00EF2592,?), ref: 00F2033E
                                                        • CloseHandle.KERNEL32(?,?,?,?,00F2017D,?,00F232FC,?,00000001,00EF2592,?), ref: 00F2034B
                                                        • CloseHandle.KERNEL32(?,?,?,?,00F2017D,?,00F232FC,?,00000001,00EF2592,?), ref: 00F20358
                                                        • CloseHandle.KERNEL32(?,?,?,?,00F2017D,?,00F232FC,?,00000001,00EF2592,?), ref: 00F20365
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: CloseHandle
                                                        • String ID:
                                                        • API String ID: 2962429428-0
                                                        • Opcode ID: 0edba2c4769d7c2ea19ea5485e128bb896180d4e5d61a7ab4b6a1a9622f7283c
                                                        • Instruction ID: d4926530e5643c92efe781f822bb83865d8b1b1710aec7e5a29f5f2c13e2ccbc
                                                        • Opcode Fuzzy Hash: 0edba2c4769d7c2ea19ea5485e128bb896180d4e5d61a7ab4b6a1a9622f7283c
                                                        • Instruction Fuzzy Hash: 8801A272801B259FC7309F66E880412FBF5BF603253158A3FD19652932C771AD54EF80
                                                        Function 00EED73A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • _free.LIBCMT ref: 00EED752
                                                          • Part of subcall function 00EE29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00EED7D1,00000000,00000000,00000000,00000000,?,00EED7F8,00000000,00000007,00000000,?,00EEDBF5,00000000), ref: 00EE29DE
                                                          • Part of subcall function 00EE29C8: GetLastError.KERNEL32(00000000,?,00EED7D1,00000000,00000000,00000000,00000000,?,00EED7F8,00000000,00000007,00000000,?,00EEDBF5,00000000,00000000), ref: 00EE29F0
                                                        • _free.LIBCMT ref: 00EED764
                                                        • _free.LIBCMT ref: 00EED776
                                                        • _free.LIBCMT ref: 00EED788
                                                        • _free.LIBCMT ref: 00EED79A
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: _free$ErrorFreeHeapLast
                                                        • String ID:
                                                        • API String ID: 776569668-0
                                                        • Opcode ID: 2e9bde9500e37d3a2fc8e957208335394e7ce75c8bdd60a3a32728bf59897eea
                                                        • Instruction ID: 35d779b69ef975841c05c66bc3908148d3ddc095a59cd914da8fdf2a5470106f
                                                        • Opcode Fuzzy Hash: 2e9bde9500e37d3a2fc8e957208335394e7ce75c8bdd60a3a32728bf59897eea
                                                        • Instruction Fuzzy Hash: 12F0123254828CAB8661EF66FDC6C1A7BEDBB44714B95380EF158F7502C735FC8086A5
                                                        Function 00F15C44 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetDlgItem.USER32(?,000003E9), ref: 00F15C58
                                                        • GetWindowTextW.USER32(00000000,?,00000100), ref: 00F15C6F
                                                        • MessageBeep.USER32(00000000), ref: 00F15C87
                                                        • KillTimer.USER32(?,0000040A), ref: 00F15CA3
                                                        • EndDialog.USER32(?,00000001), ref: 00F15CBD
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: BeepDialogItemKillMessageTextTimerWindow
                                                        • String ID:
                                                        • API String ID: 3741023627-0
                                                        • Opcode ID: 69af28247ea801eccec96aa3a37d37cc5adc215eba8616b15af2d8a7e2ba8525
                                                        • Instruction ID: 520ac649dd963af4a9892c1acc65722cc8caf3ac56eed5450e55bc579e0e63ad
                                                        • Opcode Fuzzy Hash: 69af28247ea801eccec96aa3a37d37cc5adc215eba8616b15af2d8a7e2ba8525
                                                        • Instruction Fuzzy Hash: 2A01D634501B08EBEB205F20DD4EFE677B8BB11F05F001159AA87A10E0DBF4A984AAD0
                                                        Function 00EE22A0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • _free.LIBCMT ref: 00EE22BE
                                                          • Part of subcall function 00EE29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00EED7D1,00000000,00000000,00000000,00000000,?,00EED7F8,00000000,00000007,00000000,?,00EEDBF5,00000000), ref: 00EE29DE
                                                          • Part of subcall function 00EE29C8: GetLastError.KERNEL32(00000000,?,00EED7D1,00000000,00000000,00000000,00000000,?,00EED7F8,00000000,00000007,00000000,?,00EEDBF5,00000000,00000000), ref: 00EE29F0
                                                        • _free.LIBCMT ref: 00EE22D0
                                                        • _free.LIBCMT ref: 00EE22E3
                                                        • _free.LIBCMT ref: 00EE22F4
                                                        • _free.LIBCMT ref: 00EE2305
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: _free$ErrorFreeHeapLast
                                                        • String ID:
                                                        • API String ID: 776569668-0
                                                        • Opcode ID: 6300f63c1619a99c08bf99e517484f38113e151cebb5034a30ab5fee3497fc28
                                                        • Instruction ID: 68e131481c32bf283d35ba8e26d43d9c8f8376a05a71a81b69af0580f283f9af
                                                        • Opcode Fuzzy Hash: 6300f63c1619a99c08bf99e517484f38113e151cebb5034a30ab5fee3497fc28
                                                        • Instruction Fuzzy Hash: 6EF0547140015C8B8622AF55BC028A93BACF758760741660FF614E6272CB350452BFE6
                                                        Function 00EC95C5 Relevance: 7.5, APIs: 5, Instructions: 29COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • EndPath.GDI32(?), ref: 00EC95D4
                                                        • StrokeAndFillPath.GDI32(?,?,00F071F7,00000000,?,?,?), ref: 00EC95F0
                                                        • SelectObject.GDI32(?,00000000), ref: 00EC9603
                                                        • DeleteObject.GDI32 ref: 00EC9616
                                                        • StrokePath.GDI32(?), ref: 00EC9631
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Path$ObjectStroke$DeleteFillSelect
                                                        • String ID:
                                                        • API String ID: 2625713937-0
                                                        • Opcode ID: d4a73974a9e9a01b600e4f05ae9bd055d0e12f222b800337ab88c8bae9733a44
                                                        • Instruction ID: 8540c7fb654db0928e7c5dec8546b9dcbc3029869cc394274a40e6044123caaf
                                                        • Opcode Fuzzy Hash: d4a73974a9e9a01b600e4f05ae9bd055d0e12f222b800337ab88c8bae9733a44
                                                        • Instruction Fuzzy Hash: BDF0373400660CEBDB265F69EE1CBB43B69BB52326F049318F925A50F1C7318997EF60
                                                        Function 00EE0F47 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: __freea$_free
                                                        • String ID: a/p$am/pm
                                                        • API String ID: 3432400110-3206640213
                                                        • Opcode ID: e01fc911694ee72abdff0d8729f724810d3440f598dc67b8ba7ed3fb1729efbe
                                                        • Instruction ID: 1611a0f398fe4fb6850602c844ec97a6d95fce11d55906a366a5ccb4d0d94001
                                                        • Opcode Fuzzy Hash: e01fc911694ee72abdff0d8729f724810d3440f598dc67b8ba7ed3fb1729efbe
                                                        • Instruction Fuzzy Hash: 33D1F17190028ECACB289F6AC845BFEB7B1FF05704F292199EA01BB654D3759DC0CB91
                                                        Function 00F37B7E Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 230COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00ED0242: EnterCriticalSection.KERNEL32(00F8070C,00F81884,?,?,00EC198B,00F82518,?,?,?,00EB12F9,00000000), ref: 00ED024D
                                                          • Part of subcall function 00ED0242: LeaveCriticalSection.KERNEL32(00F8070C,?,00EC198B,00F82518,?,?,?,00EB12F9,00000000), ref: 00ED028A
                                                          • Part of subcall function 00EB9CB3: _wcslen.LIBCMT ref: 00EB9CBD
                                                          • Part of subcall function 00ED00A3: __onexit.LIBCMT ref: 00ED00A9
                                                        • __Init_thread_footer.LIBCMT ref: 00F37BFB
                                                          • Part of subcall function 00ED01F8: EnterCriticalSection.KERNEL32(00F8070C,?,?,00EC8747,00F82514), ref: 00ED0202
                                                          • Part of subcall function 00ED01F8: LeaveCriticalSection.KERNEL32(00F8070C,?,00EC8747,00F82514), ref: 00ED0235
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit_wcslen
                                                        • String ID: 5$G$Variable must be of type 'Object'.
                                                        • API String ID: 535116098-3733170431
                                                        • Opcode ID: 7eb10b4b6f85d7cb49aca7ba5a6f0d631bbb006a42ce9aeec773898708d6ecf0
                                                        • Instruction ID: 9fc8c1095c170264db7c9cad1af26df1f9ea183beb90e6183e5a448b90239be8
                                                        • Opcode Fuzzy Hash: 7eb10b4b6f85d7cb49aca7ba5a6f0d631bbb006a42ce9aeec773898708d6ecf0
                                                        • Instruction Fuzzy Hash: 20917CB1A04209EFCB24EF54D891DADB7B1FF44324F148059F806AB292DB71AE41EB51
                                                        Function 00EE5AA9 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 186COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: JO
                                                        • API String ID: 0-1663374661
                                                        • Opcode ID: 3d2823917616bd77daa369233e1074273cdc9b7a74158d7fed01db76559b4dc1
                                                        • Instruction ID: fa6f448d9aadba8ea51db7919e1af4ef48410733c6dfb1e269fcc0e5dd75d68e
                                                        • Opcode Fuzzy Hash: 3d2823917616bd77daa369233e1074273cdc9b7a74158d7fed01db76559b4dc1
                                                        • Instruction Fuzzy Hash: 9951CF7290068D9BCB10DFA6CC45FEEBBB8EF45318F24205AF405BB292D6719901DB61
                                                        Function 00EE8A61 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 124COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,00000002,00000000,?,?,?,00000000,?,?,?,?), ref: 00EE8B6E
                                                        • GetLastError.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,00000000,00001000,?), ref: 00EE8B7A
                                                        • __dosmaperr.LIBCMT ref: 00EE8B81
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: ByteCharErrorLastMultiWide__dosmaperr
                                                        • String ID: .
                                                        • API String ID: 2434981716-3963672497
                                                        • Opcode ID: c406085ee4caf0bb0190e071af6fc18dce24afd55c9bfddedfeabd9a78c6e161
                                                        • Instruction ID: faf45b1533cc5309d9ce8f6ae24ef6ad962f776cad2a811b3e23f88c9b655d43
                                                        • Opcode Fuzzy Hash: c406085ee4caf0bb0190e071af6fc18dce24afd55c9bfddedfeabd9a78c6e161
                                                        • Instruction Fuzzy Hash: F14160745040CDAFD7259F55CD81ABD7FD6DF85304B18A1AAF48DA7252DE318C02D790
                                                        Function 00F12716 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00F1B403: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00F121D0,?,?,00000034,00000800,?,00000034), ref: 00F1B42D
                                                        • SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00F12760
                                                          • Part of subcall function 00F1B3CE: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00F121FF,?,?,00000800,?,00001073,00000000,?,?), ref: 00F1B3F8
                                                          • Part of subcall function 00F1B32A: GetWindowThreadProcessId.USER32(?,?), ref: 00F1B355
                                                          • Part of subcall function 00F1B32A: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00F12194,00000034,?,?,00001004,00000000,00000000), ref: 00F1B365
                                                          • Part of subcall function 00F1B32A: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00F12194,00000034,?,?,00001004,00000000,00000000), ref: 00F1B37B
                                                        • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00F127CD
                                                        • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00F1281A
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
                                                        • String ID: @
                                                        • API String ID: 4150878124-2766056989
                                                        • Opcode ID: a2ea4014dab2990d63fedf9c6585726273529b74c4c14992397d89eaac08e0a9
                                                        • Instruction ID: 0ad5c7492334ea3a754b8b1b6f1d91c4809cb6fea249e03f6d8c2fe2633e6085
                                                        • Opcode Fuzzy Hash: a2ea4014dab2990d63fedf9c6585726273529b74c4c14992397d89eaac08e0a9
                                                        • Instruction Fuzzy Hash: E2414F76D00218AFDB10DFA4CD85ADEBBB8EF09310F008095FA55B7181DB716E85DBA0
                                                        Function 00EE172E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\file.exe,00000104), ref: 00EE1769
                                                        • _free.LIBCMT ref: 00EE1834
                                                        • _free.LIBCMT ref: 00EE183E
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: _free$FileModuleName
                                                        • String ID: C:\Users\user\Desktop\file.exe
                                                        • API String ID: 2506810119-1957095476
                                                        • Opcode ID: 4b1d2ab059374156afedf2edf109937298030ffbc331e1d853fec343cb0b5a17
                                                        • Instruction ID: cb3f8ebf8f25af36989d240ce94b8cf3e41c0c0b9e1f3751685f95b81206ffe1
                                                        • Opcode Fuzzy Hash: 4b1d2ab059374156afedf2edf109937298030ffbc331e1d853fec343cb0b5a17
                                                        • Instruction Fuzzy Hash: 74318271A0029CABDB25DF9ADC81DDEBBFCEB85714B1051ABF804E7211D6708E81DB90
                                                        Function 00F1C27D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00F1C306
                                                        • DeleteMenu.USER32(?,00000007,00000000), ref: 00F1C34C
                                                        • DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00F81990,010355C8), ref: 00F1C395
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Menu$Delete$InfoItem
                                                        • String ID: 0
                                                        • API String ID: 135850232-4108050209
                                                        • Opcode ID: 88f1809617f5d55ebb29c2f5a46a5f9625a1554c20f30ae8b94050c6416b505e
                                                        • Instruction ID: 948cd9d364b7443d25e8630b5cb108ce94b6f8c5161faf956b0abdd21087a3f7
                                                        • Opcode Fuzzy Hash: 88f1809617f5d55ebb29c2f5a46a5f9625a1554c20f30ae8b94050c6416b505e
                                                        • Instruction Fuzzy Hash: 7B41B0316443019FD724DF25DC84B9ABBE4AF85320F048A1EF9A5972D1D730E945EBA2
                                                        Function 00F44416 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,00F4CC08,00000000,?,?,?,?), ref: 00F444AA
                                                        • GetWindowLongW.USER32 ref: 00F444C7
                                                        • SetWindowLongW.USER32(?,000000F0,00000000), ref: 00F444D7
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Window$Long
                                                        • String ID: SysTreeView32
                                                        • API String ID: 847901565-1698111956
                                                        • Opcode ID: 89fccd4240f3f801c6c6a7f582d9a4f93ccda871f8b7a17d8af98e0d1130b447
                                                        • Instruction ID: 4382ae039f0b3feb968fe374335de784c8657acae948320138569b04a2bc6872
                                                        • Opcode Fuzzy Hash: 89fccd4240f3f801c6c6a7f582d9a4f93ccda871f8b7a17d8af98e0d1130b447
                                                        • Instruction Fuzzy Hash: 0F31AF32610205AFDF209E38DC45BEA7BA9EB08334F245315FD79A21E0D774EC51AB50
                                                        Function 00F3304E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00F3335B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,00F33077,?,?), ref: 00F33378
                                                        • inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00F3307A
                                                        • _wcslen.LIBCMT ref: 00F3309B
                                                        • htons.WSOCK32(00000000,?,?,00000000), ref: 00F33106
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: ByteCharMultiWide_wcslenhtonsinet_addr
                                                        • String ID: 255.255.255.255
                                                        • API String ID: 946324512-2422070025
                                                        • Opcode ID: 72dd598b8c4629abcbc6f2a7641c51d3d71a572320f1e1236dd87c643e9c349d
                                                        • Instruction ID: 5937b12755c02ad08114d8218a84b58ea29bc2e47b91eaa0dbd1d961685c972b
                                                        • Opcode Fuzzy Hash: 72dd598b8c4629abcbc6f2a7641c51d3d71a572320f1e1236dd87c643e9c349d
                                                        • Instruction Fuzzy Hash: 3531F57AA042059FC714DF28C485EAA77F0EF14338F248059E9159F392DB31DE41E760
                                                        Function 00F43EB8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00F43F40
                                                        • SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00F43F54
                                                        • SendMessageW.USER32(?,00001002,00000000,?), ref: 00F43F78
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: MessageSend$Window
                                                        • String ID: SysMonthCal32
                                                        • API String ID: 2326795674-1439706946
                                                        • Opcode ID: b3cd60435af642d2fc1e2c586842c0c6784511f25f38578cbf65b7971afd02c3
                                                        • Instruction ID: 96bcba457f2dc21defb46a53c852a7742a12805a090dd69754be906b55e05b5e
                                                        • Opcode Fuzzy Hash: b3cd60435af642d2fc1e2c586842c0c6784511f25f38578cbf65b7971afd02c3
                                                        • Instruction Fuzzy Hash: A021BF32A00219BBDF259F50CC46FEA3B79EF48724F110214FE196B1D0D6B5A854AB90
                                                        Function 00F44653 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00F44705
                                                        • SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00F44713
                                                        • DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00F4471A
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: MessageSend$DestroyWindow
                                                        • String ID: msctls_updown32
                                                        • API String ID: 4014797782-2298589950
                                                        • Opcode ID: 93f810982481b77dec4db8378659b9e55ab4955b0589c9017192133bea1c5a01
                                                        • Instruction ID: 8524596c3c827172157e4666f1cb035154d7fb6973ead7acdee20887ef6b9138
                                                        • Opcode Fuzzy Hash: 93f810982481b77dec4db8378659b9e55ab4955b0589c9017192133bea1c5a01
                                                        • Instruction Fuzzy Hash: CB214CB5600209AFEB10DF64DC81DB73BADEB5A3A4B050159FA04AB351CB30FC12EA60
                                                        Function 00F195AD Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 85COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: _wcslen
                                                        • String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
                                                        • API String ID: 176396367-2734436370
                                                        • Opcode ID: a437daa1712936c9d2d84c9ee9e44686086213cb8f0f259bb76f344c9812bade
                                                        • Instruction ID: 25451d4256e2d49b8eff024d591c26da7035edb183062af9d3cce1cb5b5432ce
                                                        • Opcode Fuzzy Hash: a437daa1712936c9d2d84c9ee9e44686086213cb8f0f259bb76f344c9812bade
                                                        • Instruction Fuzzy Hash: 8F21683250811166D331AB24DC22FF773D9EF91320F044026FD49A7181EBE1ADC6E6E1
                                                        Function 00F437B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00F43840
                                                        • SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00F43850
                                                        • MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00F43876
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: MessageSend$MoveWindow
                                                        • String ID: Listbox
                                                        • API String ID: 3315199576-2633736733
                                                        • Opcode ID: f2e8cb708261990ec2fb0efe604ededf27d48bd719b3aa53edff0e429fe5ffc6
                                                        • Instruction ID: e6a402efa624a05a789201a27e36f71d87acbc7a58248f2397b9ec9bbf13b9b5
                                                        • Opcode Fuzzy Hash: f2e8cb708261990ec2fb0efe604ededf27d48bd719b3aa53edff0e429fe5ffc6
                                                        • Instruction Fuzzy Hash: C821CF72A10218BBEF219F54CC81FBB3B6EEF99760F118124FD449B190C675DC52A7A0
                                                        Function 00F249F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SetErrorMode.KERNEL32(00000001), ref: 00F24A08
                                                        • GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00F24A5C
                                                        • SetErrorMode.KERNEL32(00000000,?,?,00F4CC08), ref: 00F24AD0
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: ErrorMode$InformationVolume
                                                        • String ID: %lu
                                                        • API String ID: 2507767853-685833217
                                                        • Opcode ID: 360111639213b3374659af72ff3e9b46f7d7778d86f0bde5f2437e990c4dab7a
                                                        • Instruction ID: ac30d4adf506442096497723600192bec7c01f76b02d8803325cac90ff02414e
                                                        • Opcode Fuzzy Hash: 360111639213b3374659af72ff3e9b46f7d7778d86f0bde5f2437e990c4dab7a
                                                        • Instruction Fuzzy Hash: 0F31A575A00108AFD710DF54C881EAA7BF8EF04308F1480A5F909EB252D775ED45DFA1
                                                        Function 00F441EB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00F4424F
                                                        • SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00F44264
                                                        • SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00F44271
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: MessageSend
                                                        • String ID: msctls_trackbar32
                                                        • API String ID: 3850602802-1010561917
                                                        • Opcode ID: b6852efa93719b0640fc19ca6c42b0e29a2a69bac88a17d1800d51eec10ccab0
                                                        • Instruction ID: 1a7211889f368a7ec13a799fbd6eca6fdc96b7c751a23b82727829e2cefec3c8
                                                        • Opcode Fuzzy Hash: b6852efa93719b0640fc19ca6c42b0e29a2a69bac88a17d1800d51eec10ccab0
                                                        • Instruction Fuzzy Hash: 6A11E331640208BEEF205E29CC06FAB3BACEF95B64F010624FE55F2090D6B1E851AB10
                                                        Function 00F12F52 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EB6B57: _wcslen.LIBCMT ref: 00EB6B6A
                                                          • Part of subcall function 00F12DA7: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00F12DC5
                                                          • Part of subcall function 00F12DA7: GetWindowThreadProcessId.USER32(?,00000000), ref: 00F12DD6
                                                          • Part of subcall function 00F12DA7: GetCurrentThreadId.KERNEL32 ref: 00F12DDD
                                                          • Part of subcall function 00F12DA7: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00F12DE4
                                                        • GetFocus.USER32 ref: 00F12F78
                                                          • Part of subcall function 00F12DEE: GetParent.USER32(00000000), ref: 00F12DF9
                                                        • GetClassNameW.USER32(?,?,00000100), ref: 00F12FC3
                                                        • EnumChildWindows.USER32(?,00F1303B), ref: 00F12FEB
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
                                                        • String ID: %s%d
                                                        • API String ID: 1272988791-1110647743
                                                        • Opcode ID: b3338537906c8f23d9de6ce52d9b3af341eda44719813ecbe05ea18d1135fb31
                                                        • Instruction ID: 489f873ccf48b19bf24a995a8d8025fa558db58dccf8a23f24c8ed8e3774caea
                                                        • Opcode Fuzzy Hash: b3338537906c8f23d9de6ce52d9b3af341eda44719813ecbe05ea18d1135fb31
                                                        • Instruction Fuzzy Hash: 1411E7756002056BCF447FB0DCD5EEE37AAAF94308F049075FD09AB152DE349985AB70
                                                        Function 00F45882 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 00F458C1
                                                        • SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 00F458EE
                                                        • DrawMenuBar.USER32(?), ref: 00F458FD
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Menu$InfoItem$Draw
                                                        • String ID: 0
                                                        • API String ID: 3227129158-4108050209
                                                        • Opcode ID: 959377508ce1dfb7ac50e7beeb69292b6fcfc777f98b888325ec82c2a7db316b
                                                        • Instruction ID: 885bf52952123d19f7e3b8d346400ae488015c3a907a67d897b8e94e83600484
                                                        • Opcode Fuzzy Hash: 959377508ce1dfb7ac50e7beeb69292b6fcfc777f98b888325ec82c2a7db316b
                                                        • Instruction Fuzzy Hash: 6D016D32501218EFDB61AF11DC44BAEBFB5FB45B60F148099FC49DA162DB308A84EF61
                                                        Function 00F0D3A0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30libraryloaderCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetProcAddress.KERNEL32(?,GetSystemWow64DirectoryW), ref: 00F0D3BF
                                                        • FreeLibrary.KERNEL32 ref: 00F0D3E5
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: AddressFreeLibraryProc
                                                        • String ID: GetSystemWow64DirectoryW$X64
                                                        • API String ID: 3013587201-2590602151
                                                        • Opcode ID: d766d542d152018b9eccc9a619b6355d139d84f4b3784f8d621b6bf485639c8d
                                                        • Instruction ID: 7d445738d3dd4bbb4e7b95071fc268e1450964145ba3d5153cc7cd9da3d852d4
                                                        • Opcode Fuzzy Hash: d766d542d152018b9eccc9a619b6355d139d84f4b3784f8d621b6bf485639c8d
                                                        • Instruction Fuzzy Hash: 03F0AB77C07A21EBC7B112904C14FADB714AF10B01B95A129FC02F21C9D720CD40B7D6
                                                        Function 00F1007F Relevance: 6.3, APIs: 4, Instructions: 322COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 1ae2b163739103ea1db13d72565cb969b9fa0f1b5fdd5dc5fc82873107d03573
                                                        • Instruction ID: 34281baf3cd072d74d630cf29defbf3e17c94acd659cf0e3aeac2d141101302f
                                                        • Opcode Fuzzy Hash: 1ae2b163739103ea1db13d72565cb969b9fa0f1b5fdd5dc5fc82873107d03573
                                                        • Instruction Fuzzy Hash: D8C14A75A0020AEFDB14CFA4C894AAEB7B5FF48314F208598E515EB251DB71EDC1EB90
                                                        Function 00F3342E Relevance: 6.3, APIs: 4, Instructions: 257COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Variant$ClearInitInitializeUninitialize
                                                        • String ID:
                                                        • API String ID: 1998397398-0
                                                        • Opcode ID: b626637422be37ebbde237bfe53bdcd65420768fa517d6c51d5828a20ff8cd37
                                                        • Instruction ID: 9bf79f8a260e1b5839ce586f61607486bdf1192c66f8457221ae4c2c6a9e91ce
                                                        • Opcode Fuzzy Hash: b626637422be37ebbde237bfe53bdcd65420768fa517d6c51d5828a20ff8cd37
                                                        • Instruction Fuzzy Hash: D5A12A756043119FC710DF28C586A6AB7E5FF88724F049859F98AAB362DB30ED01DB91
                                                        Function 00F10436 Relevance: 6.2, APIs: 4, Instructions: 230COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00F4FC08,?), ref: 00F105F0
                                                        • CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00F4FC08,?), ref: 00F10608
                                                        • CLSIDFromProgID.OLE32(?,?,00000000,00F4CC40,000000FF,?,00000000,00000800,00000000,?,00F4FC08,?), ref: 00F1062D
                                                        • _memcmp.LIBVCRUNTIME ref: 00F1064E
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: FromProg$FreeTask_memcmp
                                                        • String ID:
                                                        • API String ID: 314563124-0
                                                        • Opcode ID: 576322453d003612ea969d00ee891356546f48c536be85c8e69ca2a29332f683
                                                        • Instruction ID: 855cfca3298af17b9467f03ed93985402748a6ff30c3f2699a9da78e2303fdee
                                                        • Opcode Fuzzy Hash: 576322453d003612ea969d00ee891356546f48c536be85c8e69ca2a29332f683
                                                        • Instruction Fuzzy Hash: 37812A75A00109EFCB04DF94C984EEEB7BAFF89315F204558F506AB250DB71AE86DB60
                                                        Function 00EF1391 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: _free
                                                        • String ID:
                                                        • API String ID: 269201875-0
                                                        • Opcode ID: bd0c0b0cfa42f77d6f4704032976254a7ea304f2992addbd278888c97ef1ba93
                                                        • Instruction ID: dbc14aa2a44e4dd17bdad0ba4dd1428b1f3291b84401baf25cf76792aa2bb4cb
                                                        • Opcode Fuzzy Hash: bd0c0b0cfa42f77d6f4704032976254a7ea304f2992addbd278888c97ef1ba93
                                                        • Instruction Fuzzy Hash: 8D416D3160010CEBDB25ABB99C456BE3AE5EF81334F1472A6FA39F6392E634484152B1
                                                        Function 00F46278 Relevance: 6.1, APIs: 4, Instructions: 138COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetWindowRect.USER32(?,?), ref: 00F462E2
                                                        • ScreenToClient.USER32(?,?), ref: 00F46315
                                                        • MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 00F46382
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Window$ClientMoveRectScreen
                                                        • String ID:
                                                        • API String ID: 3880355969-0
                                                        • Opcode ID: 36f04a3d65bae9a4a87d97b0d9b1f560d20ade92a69390b01b3aa79050f307fb
                                                        • Instruction ID: 8beef18f118996db98c845b3bf5cb1060457ffef5a5adebaded70a9c86429a6d
                                                        • Opcode Fuzzy Hash: 36f04a3d65bae9a4a87d97b0d9b1f560d20ade92a69390b01b3aa79050f307fb
                                                        • Instruction Fuzzy Hash: E8511B74A00249AFDF14DF54D8809BE7BB5FB56364F108259F815D7290D730AD41EB91
                                                        Function 00F31AD6 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • socket.WSOCK32(00000002,00000002,00000011), ref: 00F31AFD
                                                        • WSAGetLastError.WSOCK32 ref: 00F31B0B
                                                        • #21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00F31B8A
                                                        • WSAGetLastError.WSOCK32 ref: 00F31B94
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: ErrorLast$socket
                                                        • String ID:
                                                        • API String ID: 1881357543-0
                                                        • Opcode ID: 21bbffeda02e1ae7c51f3c53195a6e4c0cce72b4c714f59ac07b17b63e488533
                                                        • Instruction ID: e28ace115d95ea77f033278aec6cb9c8726049e06e75fcaba4b3e460c09445b6
                                                        • Opcode Fuzzy Hash: 21bbffeda02e1ae7c51f3c53195a6e4c0cce72b4c714f59ac07b17b63e488533
                                                        • Instruction Fuzzy Hash: 3741C434600200AFE720AF24C886F6677E5AB84728F54949CF91AAF7D3D776DD42CB90
                                                        Function 00EEB41F Relevance: 6.1, APIs: 4, Instructions: 133COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 5d965f4ace8321b27a13fb683bce76a77bf642e9358b8adf2e618d5dcdce1045
                                                        • Instruction ID: 3f0aadefa2bf83b566a846a69fbbcd1d1b4f1dcbab8dcc4ece3d4136ec1d43ca
                                                        • Opcode Fuzzy Hash: 5d965f4ace8321b27a13fb683bce76a77bf642e9358b8adf2e618d5dcdce1045
                                                        • Instruction Fuzzy Hash: BD410871A0034CAFD7249F79CC41BABBBE9EB84710F10556EF551EB2D2E77199018780
                                                        Function 00F256D9 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00F25783
                                                        • GetLastError.KERNEL32(?,00000000), ref: 00F257A9
                                                        • DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00F257CE
                                                        • CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00F257FA
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: CreateHardLink$DeleteErrorFileLast
                                                        • String ID:
                                                        • API String ID: 3321077145-0
                                                        • Opcode ID: a69dad7f7a9b5a4ce6c6b8d23ec5619ba25b31cde6148565c3a5b713381836e6
                                                        • Instruction ID: 4d346f1168164d50155826ec147d52340cf46994d3584ce9183939b8dcfaa5cb
                                                        • Opcode Fuzzy Hash: a69dad7f7a9b5a4ce6c6b8d23ec5619ba25b31cde6148565c3a5b713381836e6
                                                        • Instruction Fuzzy Hash: F3412B39600610DFCB21DF15C445A9EBBE2AF89720B18C498E84AAB762CB74FD40DB91
                                                        Function 00EED8C3 Relevance: 6.1, APIs: 4, Instructions: 110COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,00ED82D9,?,00ED82D9,?,00000001,?,?,00000001,00ED82D9,00ED82D9), ref: 00EED910
                                                        • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00EED999
                                                        • GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00EED9AB
                                                        • __freea.LIBCMT ref: 00EED9B4
                                                          • Part of subcall function 00EE3820: RtlAllocateHeap.NTDLL(00000000,?,00F81444,?,00ECFDF5,?,?,00EBA976,00000010,00F81440,00EB13FC,?,00EB13C6,?,00EB1129), ref: 00EE3852
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: ByteCharMultiWide$AllocateHeapStringType__freea
                                                        • String ID:
                                                        • API String ID: 2652629310-0
                                                        • Opcode ID: 44507c13c2a76560f49bad89a4961dc2b8c16426101bcecb12dd8a8f03e29ac2
                                                        • Instruction ID: d12d4926298b10f9e2b4775776531d83cce3300c9dbbb28d3278b38e2121aeb4
                                                        • Opcode Fuzzy Hash: 44507c13c2a76560f49bad89a4961dc2b8c16426101bcecb12dd8a8f03e29ac2
                                                        • Instruction Fuzzy Hash: 7531D072A0024EABDF24CF66DC45EAE7BA5EB81314F054169FC04E7251EB76CD50CBA0
                                                        Function 00F452C1 Relevance: 6.1, APIs: 4, Instructions: 104windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SendMessageW.USER32(?,00001024,00000000,?), ref: 00F45352
                                                        • GetWindowLongW.USER32(?,000000F0), ref: 00F45375
                                                        • SetWindowLongW.USER32(?,000000F0,00000000), ref: 00F45382
                                                        • InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00F453A8
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: LongWindow$InvalidateMessageRectSend
                                                        • String ID:
                                                        • API String ID: 3340791633-0
                                                        • Opcode ID: dae7462e24edfba7b407e03511863011b248e91e45df2fc30f9b0d4a66096256
                                                        • Instruction ID: a63ea9c6ae13d67e42f541d162c31e550af47f54dcb3094d2dafbab7cf2c19a4
                                                        • Opcode Fuzzy Hash: dae7462e24edfba7b407e03511863011b248e91e45df2fc30f9b0d4a66096256
                                                        • Instruction Fuzzy Hash: 6A31A135E55A0CAFEB20AE54CC45BF83FA7AB05BA0F585141FE10962E2C7B59D40BB81
                                                        Function 00F1AB9C Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 00F1ABF1
                                                        • SetKeyboardState.USER32(00000080,?,00008000), ref: 00F1AC0D
                                                        • PostMessageW.USER32(00000000,00000101,00000000), ref: 00F1AC74
                                                        • SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 00F1ACC6
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: KeyboardState$InputMessagePostSend
                                                        • String ID:
                                                        • API String ID: 432972143-0
                                                        • Opcode ID: 35c5bda88e65db3bffee6c7c16f348d36ee12dbbe00ff705fd7e61f969b8224a
                                                        • Instruction ID: 4b72d628ad9efc079c81ae44cfefa7ed4730bc462542e42c7f59cc560a07d174
                                                        • Opcode Fuzzy Hash: 35c5bda88e65db3bffee6c7c16f348d36ee12dbbe00ff705fd7e61f969b8224a
                                                        • Instruction Fuzzy Hash: 6F312630E05718AFEF35CB658C147FA7BA5AB99320F04421AE485922D1D379C9C5A7D2
                                                        Function 00F47674 Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • ClientToScreen.USER32(?,?), ref: 00F4769A
                                                        • GetWindowRect.USER32(?,?), ref: 00F47710
                                                        • PtInRect.USER32(?,?,00F48B89), ref: 00F47720
                                                        • MessageBeep.USER32(00000000), ref: 00F4778C
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Rect$BeepClientMessageScreenWindow
                                                        • String ID:
                                                        • API String ID: 1352109105-0
                                                        • Opcode ID: 4fe9bcebb51870a87bb93e17dec2d5c2ad547ad66b56cb8f5b94d031639776f7
                                                        • Instruction ID: a437ddf8df109aa9c5e7586f0bf9f7cb952221b1671a75f81fc692272c454b79
                                                        • Opcode Fuzzy Hash: 4fe9bcebb51870a87bb93e17dec2d5c2ad547ad66b56cb8f5b94d031639776f7
                                                        • Instruction Fuzzy Hash: 67417E39A05318DFDB11EF58C894EA9BFF9BF49314F5541A8EC149B261C730A942EB90
                                                        Function 00F416DA Relevance: 6.1, APIs: 4, Instructions: 101COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetForegroundWindow.USER32 ref: 00F416EB
                                                          • Part of subcall function 00F13A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00F13A57
                                                          • Part of subcall function 00F13A3D: GetCurrentThreadId.KERNEL32 ref: 00F13A5E
                                                          • Part of subcall function 00F13A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00F125B3), ref: 00F13A65
                                                        • GetCaretPos.USER32(?), ref: 00F416FF
                                                        • ClientToScreen.USER32(00000000,?), ref: 00F4174C
                                                        • GetForegroundWindow.USER32 ref: 00F41752
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
                                                        • String ID:
                                                        • API String ID: 2759813231-0
                                                        • Opcode ID: 86450276778ee2c11f6ec59d589b1536d215e89fe915ec1ed8f2f3761d58b8ea
                                                        • Instruction ID: 3135b14120a270daca4fb1814a82b145956e9723275662d0192119f39c1575fd
                                                        • Opcode Fuzzy Hash: 86450276778ee2c11f6ec59d589b1536d215e89fe915ec1ed8f2f3761d58b8ea
                                                        • Instruction Fuzzy Hash: FC314175E00149AFC700EFA9C881CEFBBF9EF48304B5490AAE415E7211D7359E45DBA0
                                                        Function 00F1DF95 Relevance: 6.1, APIs: 4, Instructions: 87COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EB7620: _wcslen.LIBCMT ref: 00EB7625
                                                        • _wcslen.LIBCMT ref: 00F1DFCB
                                                        • _wcslen.LIBCMT ref: 00F1DFE2
                                                        • _wcslen.LIBCMT ref: 00F1E00D
                                                        • GetTextExtentPoint32W.GDI32(?,00000000,00000000,?), ref: 00F1E018
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: _wcslen$ExtentPoint32Text
                                                        • String ID:
                                                        • API String ID: 3763101759-0
                                                        • Opcode ID: e3f832cc1e205e9b6696c06ad80b09ea1766db7a57e21c1e0b4944756bc0617a
                                                        • Instruction ID: 76ed4df0522b5fd0c0a24d92714105b0aff8926e128189ecc2fa314e25b97694
                                                        • Opcode Fuzzy Hash: e3f832cc1e205e9b6696c06ad80b09ea1766db7a57e21c1e0b4944756bc0617a
                                                        • Instruction Fuzzy Hash: 2F21E571D00214AFCB10DFA8C981BAEB7F8EF89760F144065E905BB385D6709E41DBE1
                                                        Function 00F1D4DC Relevance: 6.1, APIs: 4, Instructions: 86processCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CreateToolhelp32Snapshot.KERNEL32 ref: 00F1D501
                                                        • Process32FirstW.KERNEL32(00000000,?), ref: 00F1D50F
                                                        • Process32NextW.KERNEL32(00000000,?), ref: 00F1D52F
                                                        • CloseHandle.KERNEL32(00000000), ref: 00F1D5DC
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
                                                        • String ID:
                                                        • API String ID: 420147892-0
                                                        • Opcode ID: 5d5cf699a870212d82359408c1c463afaa3b5a32329294a21f63b08dc8d4f101
                                                        • Instruction ID: 81526380b661172590af612234c54c99425d3eb3a8cea8f8a97780af94ce55f7
                                                        • Opcode Fuzzy Hash: 5d5cf699a870212d82359408c1c463afaa3b5a32329294a21f63b08dc8d4f101
                                                        • Instruction Fuzzy Hash: 6531AD721083009FD305EF54C881AEFBBF8EFDA354F14092DF581921A2EB719989DB92
                                                        Function 00F48FC9 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EC9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00EC9BB2
                                                        • GetCursorPos.USER32(?), ref: 00F49001
                                                        • TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00F07711,?,?,?,?,?), ref: 00F49016
                                                        • GetCursorPos.USER32(?), ref: 00F4905E
                                                        • DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00F07711,?,?,?), ref: 00F49094
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Cursor$LongMenuPopupProcTrackWindow
                                                        • String ID:
                                                        • API String ID: 2864067406-0
                                                        • Opcode ID: c5dfda05c36f7978e53d8f741a6388bdcc10aac4a1f3710ca0238e001e8a92e8
                                                        • Instruction ID: d3d2ee92884d69d698a57df277cea64c02b195a4de78557b0b16117dea889679
                                                        • Opcode Fuzzy Hash: c5dfda05c36f7978e53d8f741a6388bdcc10aac4a1f3710ca0238e001e8a92e8
                                                        • Instruction Fuzzy Hash: 7921AD35B01018AFDB25CFA8C858EFB3FB9FB8A360F044159F9055B261C7719951EBA0
                                                        Function 00F1D2C1 Relevance: 6.1, APIs: 4, Instructions: 78COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetFileAttributesW.KERNEL32(?,00F4CB68), ref: 00F1D2FB
                                                        • GetLastError.KERNEL32 ref: 00F1D30A
                                                        • CreateDirectoryW.KERNEL32(?,00000000), ref: 00F1D319
                                                        • CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,00F4CB68), ref: 00F1D376
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: CreateDirectory$AttributesErrorFileLast
                                                        • String ID:
                                                        • API String ID: 2267087916-0
                                                        • Opcode ID: c55de882fcdb8c767c38b77fa4b46672f693d33e633d91107920a6509bbb7da7
                                                        • Instruction ID: fc7bf3886d1a0ed61a80ae39c9d584b5afb8a07d26aa0b10b8dbf439178a38e1
                                                        • Opcode Fuzzy Hash: c55de882fcdb8c767c38b77fa4b46672f693d33e633d91107920a6509bbb7da7
                                                        • Instruction Fuzzy Hash: 9921A3749052019F8714DF24C8814EB77F4EE56368F105A1DF8A9D32A1D731D986EB93
                                                        Function 00F11571 Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00F11014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00F1102A
                                                          • Part of subcall function 00F11014: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00F11036
                                                          • Part of subcall function 00F11014: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00F11045
                                                          • Part of subcall function 00F11014: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00F1104C
                                                          • Part of subcall function 00F11014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00F11062
                                                        • LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00F115BE
                                                        • _memcmp.LIBVCRUNTIME ref: 00F115E1
                                                        • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00F11617
                                                        • HeapFree.KERNEL32(00000000), ref: 00F1161E
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
                                                        • String ID:
                                                        • API String ID: 1592001646-0
                                                        • Opcode ID: 97db4dc86042316622364ed213c08e264994d8c28713bd796d0db9bfacc7f5fd
                                                        • Instruction ID: ffb957e4325e930c550f85d4ee88a6e754f49babb8aac8ee5cbf6a3eeb06b842
                                                        • Opcode Fuzzy Hash: 97db4dc86042316622364ed213c08e264994d8c28713bd796d0db9bfacc7f5fd
                                                        • Instruction Fuzzy Hash: 0221AC31E01108EFEF10DFA4C945BEEB7B9FF84354F094459E941AB241E731AA85EBA0
                                                        Function 00F42782 Relevance: 6.1, APIs: 4, Instructions: 75COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetWindowLongW.USER32(?,000000EC), ref: 00F4280A
                                                        • SetWindowLongW.USER32(?,000000EC,00000000), ref: 00F42824
                                                        • SetWindowLongW.USER32(?,000000EC,00000000), ref: 00F42832
                                                        • SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00F42840
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Window$Long$AttributesLayered
                                                        • String ID:
                                                        • API String ID: 2169480361-0
                                                        • Opcode ID: 85e583f51ba1dca17a09afb0016c70b4b57ee582b977bcc1a326f0b5fa660d51
                                                        • Instruction ID: c8290cedfc48a70d0af919768b8345073a4d4d3852f7b5172f361c6bbee5abee
                                                        • Opcode Fuzzy Hash: 85e583f51ba1dca17a09afb0016c70b4b57ee582b977bcc1a326f0b5fa660d51
                                                        • Instruction Fuzzy Hash: 89210335605110AFD7549B24CC44FAA7B99EF46324F198168FC268B2E2CB75FC82DBD0
                                                        Function 00F178F5 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00F18D7D: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,00F1790A,?,000000FF,?,00F18754,00000000,?,0000001C,?,?), ref: 00F18D8C
                                                          • Part of subcall function 00F18D7D: lstrcpyW.KERNEL32(00000000,?,?,00F1790A,?,000000FF,?,00F18754,00000000,?,0000001C,?,?,00000000), ref: 00F18DB2
                                                          • Part of subcall function 00F18D7D: lstrcmpiW.KERNEL32(00000000,?,00F1790A,?,000000FF,?,00F18754,00000000,?,0000001C,?,?), ref: 00F18DE3
                                                        • lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,00F18754,00000000,?,0000001C,?,?,00000000), ref: 00F17923
                                                        • lstrcpyW.KERNEL32(00000000,?,?,00F18754,00000000,?,0000001C,?,?,00000000), ref: 00F17949
                                                        • lstrcmpiW.KERNEL32(00000002,cdecl,?,00F18754,00000000,?,0000001C,?,?,00000000), ref: 00F17984
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: lstrcmpilstrcpylstrlen
                                                        • String ID: cdecl
                                                        • API String ID: 4031866154-3896280584
                                                        • Opcode ID: 0de934c85275943b918222f7a20f98f61dbec133ee42b6865fd68be20e6c2d8d
                                                        • Instruction ID: b09931d72bc875d1e5d005d5d46655bc422bdf148f67c246f0acf85f1df1564e
                                                        • Opcode Fuzzy Hash: 0de934c85275943b918222f7a20f98f61dbec133ee42b6865fd68be20e6c2d8d
                                                        • Instruction Fuzzy Hash: 8611063A200301AFCB15AF34DC44EBA77B5FF953A0B50502AF906C72A4EB319841E791
                                                        Function 00F47CC2 Relevance: 6.1, APIs: 4, Instructions: 70COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetWindowLongW.USER32(?,000000F0), ref: 00F47D0B
                                                        • SetWindowLongW.USER32(00000000,000000F0,?), ref: 00F47D2A
                                                        • SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00F47D42
                                                        • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00F2B7AD,00000000), ref: 00F47D6B
                                                          • Part of subcall function 00EC9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00EC9BB2
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Window$Long
                                                        • String ID:
                                                        • API String ID: 847901565-0
                                                        • Opcode ID: a08e981099dd57a448d6e3e6526e39b0ddaf99531660ab51874529da817089d0
                                                        • Instruction ID: daa939482d47a76511ee8e153bfda9b4257953e5dc40c5706118db88820c13c2
                                                        • Opcode Fuzzy Hash: a08e981099dd57a448d6e3e6526e39b0ddaf99531660ab51874529da817089d0
                                                        • Instruction Fuzzy Hash: 16119335915619AFCB10AF28CC04AB63BA9BF46370B154724FC39D72F0D7309951EB90
                                                        Function 00F45660 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SendMessageW.USER32(?,00001060,?,00000004), ref: 00F456BB
                                                        • _wcslen.LIBCMT ref: 00F456CD
                                                        • _wcslen.LIBCMT ref: 00F456D8
                                                        • SendMessageW.USER32(?,00001002,00000000,?), ref: 00F45816
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: MessageSend_wcslen
                                                        • String ID:
                                                        • API String ID: 455545452-0
                                                        • Opcode ID: 0d083ba911337c532b78387e92feb70130748113f8081853f98620c92ddee6f7
                                                        • Instruction ID: 0263d15a4596222ee49baa85e2fd6479b2098eda2353bc99080948a88d111d00
                                                        • Opcode Fuzzy Hash: 0d083ba911337c532b78387e92feb70130748113f8081853f98620c92ddee6f7
                                                        • Instruction Fuzzy Hash: B911D676A00609A7DF20EF61CC85AEE7FACEF11B70B104126FD15D6182E770C985EB60
                                                        Function 00EE1D09 Relevance: 6.1, APIs: 4, Instructions: 63COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: dd8cda326bdd4a470073248b13b62925e822de39d1f1806d224130155482043c
                                                        • Instruction ID: 245ae72c7a507e5608e74b65613eab721c16cf7f7fd510a272fe76063361bc8f
                                                        • Opcode Fuzzy Hash: dd8cda326bdd4a470073248b13b62925e822de39d1f1806d224130155482043c
                                                        • Instruction Fuzzy Hash: E201A2B220A69E3EF6111A7A6CC1F67665CDF813B9B313369F521721D2DB718C805160
                                                        Function 00F11A27 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SendMessageW.USER32(?,000000B0,?,?), ref: 00F11A47
                                                        • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00F11A59
                                                        • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00F11A6F
                                                        • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00F11A8A
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: MessageSend
                                                        • String ID:
                                                        • API String ID: 3850602802-0
                                                        • Opcode ID: 9d5d1fc6f81c8a030d981ea8e2e5ac23b6672b3be264fada9eeefaef294a9c6a
                                                        • Instruction ID: 1bbea2bb65b87c40498f4d670ce790139663af64f390c488bee94a3f67f03aa4
                                                        • Opcode Fuzzy Hash: 9d5d1fc6f81c8a030d981ea8e2e5ac23b6672b3be264fada9eeefaef294a9c6a
                                                        • Instruction Fuzzy Hash: 4811E53AD01219FFEB119BA58985FADBB78FF08750F200091EA04B7290D6716E50AB94
                                                        Function 00F1E1D6 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetCurrentThreadId.KERNEL32 ref: 00F1E1FD
                                                        • MessageBoxW.USER32(?,?,?,?), ref: 00F1E230
                                                        • WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00F1E246
                                                        • CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00F1E24D
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: CloseCurrentHandleMessageObjectSingleThreadWait
                                                        • String ID:
                                                        • API String ID: 2880819207-0
                                                        • Opcode ID: 2a093e42266717669cf720b3af50c0bf6d7488903baa1f8bfe518ff2c064f058
                                                        • Instruction ID: 8f04275dc0ba3104a68298e5d6a874b9d675ea833524ba8f166a1c0dd121ce15
                                                        • Opcode Fuzzy Hash: 2a093e42266717669cf720b3af50c0bf6d7488903baa1f8bfe518ff2c064f058
                                                        • Instruction Fuzzy Hash: 8011C876E04258BBD7019FA89C09AEE7FACAB46320F144355FD14E3291D6B0C94497A0
                                                        Function 00EDD1CC Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CreateThread.KERNEL32(00000000,?,00EDCFF9,00000000,00000004,00000000), ref: 00EDD218
                                                        • GetLastError.KERNEL32 ref: 00EDD224
                                                        • __dosmaperr.LIBCMT ref: 00EDD22B
                                                        • ResumeThread.KERNEL32(00000000), ref: 00EDD249
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Thread$CreateErrorLastResume__dosmaperr
                                                        • String ID:
                                                        • API String ID: 173952441-0
                                                        • Opcode ID: b06731aef86f6e9026929aa089c11b8c933d5db861379183c65d6f68ce263ef8
                                                        • Instruction ID: 104a4b70da5b7f70d694ec4cb1dca743a275fd4e2c2ea2777b4a8216ef6b5086
                                                        • Opcode Fuzzy Hash: b06731aef86f6e9026929aa089c11b8c933d5db861379183c65d6f68ce263ef8
                                                        • Instruction Fuzzy Hash: 9601D636409208BBC7115FA5DC05BAE7AADDF92334F10221AF925B63E0CB718902D6A0
                                                        Function 00F49EF3 Relevance: 6.1, APIs: 4, Instructions: 55COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EC9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00EC9BB2
                                                        • GetClientRect.USER32(?,?), ref: 00F49F31
                                                        • GetCursorPos.USER32(?), ref: 00F49F3B
                                                        • ScreenToClient.USER32(?,?), ref: 00F49F46
                                                        • DefDlgProcW.USER32(?,00000020,?,00000000,?,?,?), ref: 00F49F7A
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Client$CursorLongProcRectScreenWindow
                                                        • String ID:
                                                        • API String ID: 4127811313-0
                                                        • Opcode ID: 828dbc93d223c6aa9b635fb528c2f061407a6961747daa558e27604718bb77bf
                                                        • Instruction ID: 918c79c037c3dddd6543eba0e3bad03af000c6d2bde86f39ec5ccf528af3f434
                                                        • Opcode Fuzzy Hash: 828dbc93d223c6aa9b635fb528c2f061407a6961747daa558e27604718bb77bf
                                                        • Instruction Fuzzy Hash: 18118836A0111AABDB00EF68C8499EE7BBCFB06321F000451FD11E3141C374BE86EBA1
                                                        Function 00EB600E Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00EB604C
                                                        • GetStockObject.GDI32(00000011), ref: 00EB6060
                                                        • SendMessageW.USER32(00000000,00000030,00000000), ref: 00EB606A
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: CreateMessageObjectSendStockWindow
                                                        • String ID:
                                                        • API String ID: 3970641297-0
                                                        • Opcode ID: 5820bba856aa40eb3b528291cd770fbd6703606970fa93a110e6284bdf63e328
                                                        • Instruction ID: af3237ec5e60cb95aaf8f20ba6e07aa676eb85f84b37682d142738c919d4cefc
                                                        • Opcode Fuzzy Hash: 5820bba856aa40eb3b528291cd770fbd6703606970fa93a110e6284bdf63e328
                                                        • Instruction Fuzzy Hash: 5E115E7250250DBFEF225F959C44AFB7B69EF19364F041215FE1466110D73ADC60AB90
                                                        Function 00ED3B3C Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • ___BuildCatchObject.LIBVCRUNTIME ref: 00ED3B56
                                                          • Part of subcall function 00ED3AA3: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 00ED3AD2
                                                          • Part of subcall function 00ED3AA3: ___AdjustPointer.LIBCMT ref: 00ED3AED
                                                        • _UnwindNestedFrames.LIBCMT ref: 00ED3B6B
                                                        • __FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 00ED3B7C
                                                        • CallCatchBlock.LIBVCRUNTIME ref: 00ED3BA4
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
                                                        • String ID:
                                                        • API String ID: 737400349-0
                                                        • Opcode ID: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
                                                        • Instruction ID: 9d948bb80d4c9dcd1c0ae637561622039dbd882413de7f23549dafc1cd6a9271
                                                        • Opcode Fuzzy Hash: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
                                                        • Instruction Fuzzy Hash: F9018072100148BBCF115FA5CC42DEB3FADEF58754F04400AFE4866221C332D962EBA1
                                                        Function 00EE3073 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00EB13C6,00000000,00000000,?,00EE301A,00EB13C6,00000000,00000000,00000000,?,00EE328B,00000006,FlsSetValue), ref: 00EE30A5
                                                        • GetLastError.KERNEL32(?,00EE301A,00EB13C6,00000000,00000000,00000000,?,00EE328B,00000006,FlsSetValue,00F52290,FlsSetValue,00000000,00000364,?,00EE2E46), ref: 00EE30B1
                                                        • LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00EE301A,00EB13C6,00000000,00000000,00000000,?,00EE328B,00000006,FlsSetValue,00F52290,FlsSetValue,00000000), ref: 00EE30BF
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: LibraryLoad$ErrorLast
                                                        • String ID:
                                                        • API String ID: 3177248105-0
                                                        • Opcode ID: fff34b67956f022b6a7a6b22676abdb9e363f1a15470ef743a8732b8ff7738f4
                                                        • Instruction ID: e274db089e20397059cee0f87f547aafc99deb682b0cacef5b93a19437990191
                                                        • Opcode Fuzzy Hash: fff34b67956f022b6a7a6b22676abdb9e363f1a15470ef743a8732b8ff7738f4
                                                        • Instruction Fuzzy Hash: 3F01203630226EABCB318BBB9C4C9A77798AF46775B101620FD05F3140C721D901C6D0
                                                        Function 00F17464 Relevance: 6.1, APIs: 4, Instructions: 51registryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetModuleFileNameW.KERNEL32(?,?,00000104,00000000), ref: 00F1747F
                                                        • LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00F17497
                                                        • RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 00F174AC
                                                        • RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 00F174CA
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Type$Register$FileLoadModuleNameUser
                                                        • String ID:
                                                        • API String ID: 1352324309-0
                                                        • Opcode ID: 4896e2ae91bb77395a83871d45bffe5e6429b946ee982ccd6b7460b7dad14f5c
                                                        • Instruction ID: 419fc03d92118ba7c3a4630f8a6055a0504bac4fff0c7bee1064d150300b7448
                                                        • Opcode Fuzzy Hash: 4896e2ae91bb77395a83871d45bffe5e6429b946ee982ccd6b7460b7dad14f5c
                                                        • Instruction Fuzzy Hash: 3211A1B5206314DBE720DF14DD08BD27BFCEB00B00F108569AA5AD71A1D774E984FB90
                                                        Function 00F1B0A8 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,00F1ACD3,?,00008000), ref: 00F1B0C4
                                                        • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,00F1ACD3,?,00008000), ref: 00F1B0E9
                                                        • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,00F1ACD3,?,00008000), ref: 00F1B0F3
                                                        • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,00F1ACD3,?,00008000), ref: 00F1B126
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: CounterPerformanceQuerySleep
                                                        • String ID:
                                                        • API String ID: 2875609808-0
                                                        • Opcode ID: 1f40908677910c4dfc3394cac749fc31d53566ad520d616b9139e10dcaa15092
                                                        • Instruction ID: a243fdfa89a7f1c1f1e1157eeceab16c64c70468ea27ecc181902ded9f647be2
                                                        • Opcode Fuzzy Hash: 1f40908677910c4dfc3394cac749fc31d53566ad520d616b9139e10dcaa15092
                                                        • Instruction Fuzzy Hash: 12116D31C0252CE7CF00AFE5E958BEEBB78FF5A711F214089D951B2281CB305690AB91
                                                        Function 00F47E14 Relevance: 6.0, APIs: 4, Instructions: 46COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetWindowRect.USER32(?,?), ref: 00F47E33
                                                        • ScreenToClient.USER32(?,?), ref: 00F47E4B
                                                        • ScreenToClient.USER32(?,?), ref: 00F47E6F
                                                        • InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00F47E8A
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: ClientRectScreen$InvalidateWindow
                                                        • String ID:
                                                        • API String ID: 357397906-0
                                                        • Opcode ID: bafb62e87e5dede0baa518e2feddc4adb113dacc8dfb2bafbd5af7bc05414f0c
                                                        • Instruction ID: 2cfcff7a337da9691b40374805efc57aaad0bba1590faae38221e654f377399a
                                                        • Opcode Fuzzy Hash: bafb62e87e5dede0baa518e2feddc4adb113dacc8dfb2bafbd5af7bc05414f0c
                                                        • Instruction Fuzzy Hash: BF1140B9D0020AAFDB41DF98C884AEEBBF9FB19310F509166E915E3210D735AA54DF90
                                                        Function 00F12DA7 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00F12DC5
                                                        • GetWindowThreadProcessId.USER32(?,00000000), ref: 00F12DD6
                                                        • GetCurrentThreadId.KERNEL32 ref: 00F12DDD
                                                        • AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00F12DE4
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
                                                        • String ID:
                                                        • API String ID: 2710830443-0
                                                        • Opcode ID: 8fd723a6ad52fddcab17ca86480219ff05b0c0b2cce48a66030a3fc6a64e4c58
                                                        • Instruction ID: ad399318790847272a5fdc4df79963f9b734e22e2be6da7cd9ae563d0bcfc529
                                                        • Opcode Fuzzy Hash: 8fd723a6ad52fddcab17ca86480219ff05b0c0b2cce48a66030a3fc6a64e4c58
                                                        • Instruction Fuzzy Hash: CAE0657550222876D76017A3EC0DFE73E5CEB53B61F015015B505D10809A908480E6F0
                                                        Function 00F48863 Relevance: 6.0, APIs: 4, Instructions: 31COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EC9639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00EC9693
                                                          • Part of subcall function 00EC9639: SelectObject.GDI32(?,00000000), ref: 00EC96A2
                                                          • Part of subcall function 00EC9639: BeginPath.GDI32(?), ref: 00EC96B9
                                                          • Part of subcall function 00EC9639: SelectObject.GDI32(?,00000000), ref: 00EC96E2
                                                        • MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 00F48887
                                                        • LineTo.GDI32(?,?,?), ref: 00F48894
                                                        • EndPath.GDI32(?), ref: 00F488A4
                                                        • StrokePath.GDI32(?), ref: 00F488B2
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
                                                        • String ID:
                                                        • API String ID: 1539411459-0
                                                        • Opcode ID: b9955ac1f453b9492dba3b44a84196bd9026a439454dbe5ad7aed494d693f1e9
                                                        • Instruction ID: 850a8658df739853a5b003d50c955420386ce0cea8e5af5b20a6132456af7b16
                                                        • Opcode Fuzzy Hash: b9955ac1f453b9492dba3b44a84196bd9026a439454dbe5ad7aed494d693f1e9
                                                        • Instruction Fuzzy Hash: 2DF03A3A042258BADB125F98AC09FDE3E59AF16310F048100FE11A50E2C7755552EBE9
                                                        Function 00EC98B0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetSysColor.USER32(00000008), ref: 00EC98CC
                                                        • SetTextColor.GDI32(?,?), ref: 00EC98D6
                                                        • SetBkMode.GDI32(?,00000001), ref: 00EC98E9
                                                        • GetStockObject.GDI32(00000005), ref: 00EC98F1
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Color$ModeObjectStockText
                                                        • String ID:
                                                        • API String ID: 4037423528-0
                                                        • Opcode ID: 5dba8cdd9b24e13462d16bf5db77cfd927dc8e288b57b744f4b9d3cd5e58b034
                                                        • Instruction ID: 0b2974d432e9e53bbf87cf5e57d0ed45fcb3f6c65fee87258e6e9c183b8c633b
                                                        • Opcode Fuzzy Hash: 5dba8cdd9b24e13462d16bf5db77cfd927dc8e288b57b744f4b9d3cd5e58b034
                                                        • Instruction Fuzzy Hash: 05E06535645284AADB615B74AC09BE83F20AB66735F049219FAF5540E1C7715640BB10
                                                        Function 00F1162B Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetCurrentThread.KERNEL32 ref: 00F11634
                                                        • OpenThreadToken.ADVAPI32(00000000,?,?,?,00F111D9), ref: 00F1163B
                                                        • GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00F111D9), ref: 00F11648
                                                        • OpenProcessToken.ADVAPI32(00000000,?,?,?,00F111D9), ref: 00F1164F
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: CurrentOpenProcessThreadToken
                                                        • String ID:
                                                        • API String ID: 3974789173-0
                                                        • Opcode ID: 794cea5382d22caff4b4156ae8eff61031ff2d8f147c3377634d5147fb0a4e95
                                                        • Instruction ID: 2d1ce30cd2377a2aca675d589f6ad139e092cb3b9f9f767d9723339535ff4c7f
                                                        • Opcode Fuzzy Hash: 794cea5382d22caff4b4156ae8eff61031ff2d8f147c3377634d5147fb0a4e95
                                                        • Instruction Fuzzy Hash: 64E04F35A022159BE7A01FA49D0DB963B68AF667A1F144808FA45C9090D6644480AB90
                                                        Function 00F0D858 Relevance: 6.0, APIs: 4, Instructions: 19COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetDesktopWindow.USER32 ref: 00F0D858
                                                        • GetDC.USER32(00000000), ref: 00F0D862
                                                        • GetDeviceCaps.GDI32(00000000,0000000C), ref: 00F0D882
                                                        • ReleaseDC.USER32(?), ref: 00F0D8A3
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: CapsDesktopDeviceReleaseWindow
                                                        • String ID:
                                                        • API String ID: 2889604237-0
                                                        • Opcode ID: 24a5ddb7e00eab1b0c0f260118d295ff37adcda9b2f9e79ffd9c5b58f26ba253
                                                        • Instruction ID: 19bdadc490bbe1ac15df9b733fea91ff0486feabc5561aa30739ab11d88685a7
                                                        • Opcode Fuzzy Hash: 24a5ddb7e00eab1b0c0f260118d295ff37adcda9b2f9e79ffd9c5b58f26ba253
                                                        • Instruction Fuzzy Hash: 03E01275805208DFCB919FA4D90866DBBF1FB19310F15E059FC0AE7250C7354501BF80
                                                        Function 00F0D86C Relevance: 6.0, APIs: 4, Instructions: 18COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetDesktopWindow.USER32 ref: 00F0D86C
                                                        • GetDC.USER32(00000000), ref: 00F0D876
                                                        • GetDeviceCaps.GDI32(00000000,0000000C), ref: 00F0D882
                                                        • ReleaseDC.USER32(?), ref: 00F0D8A3
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: CapsDesktopDeviceReleaseWindow
                                                        • String ID:
                                                        • API String ID: 2889604237-0
                                                        • Opcode ID: ed3b93855970766238f60c8ddad9a2d65e10c86ba0253214e99425207ecde1cc
                                                        • Instruction ID: 404b2ae5048e555f84f2eb2be78833af558c919cf3803b62c10e09273a1ea54a
                                                        • Opcode Fuzzy Hash: ed3b93855970766238f60c8ddad9a2d65e10c86ba0253214e99425207ecde1cc
                                                        • Instruction Fuzzy Hash: 32E01A78805208DFCB909FA4D80866DBBF1BB18310B15A048FC0AE7260C7395901AF80
                                                        Function 00F24D87 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EB7620: _wcslen.LIBCMT ref: 00EB7625
                                                        • WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 00F24ED4
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Connection_wcslen
                                                        • String ID: *$LPT
                                                        • API String ID: 1725874428-3443410124
                                                        • Opcode ID: b7683f0648d0e991d62d8f7be7d0d125d4937522373d5a314f3d56a5d7ed7bdd
                                                        • Instruction ID: f74a511435d70ce15cf5caec42acfceb053817e333e20b82f90f09ff8bd3ea51
                                                        • Opcode Fuzzy Hash: b7683f0648d0e991d62d8f7be7d0d125d4937522373d5a314f3d56a5d7ed7bdd
                                                        • Instruction Fuzzy Hash: 1F91D075A002149FCB14DF58C580EAABBF1BF84314F198099E80AAF3A2C771ED85DB90
                                                        Function 00EDE27D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • __startOneArgErrorHandling.LIBCMT ref: 00EDE30D
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: ErrorHandling__start
                                                        • String ID: pow
                                                        • API String ID: 3213639722-2276729525
                                                        • Opcode ID: 96dfbbe85f1f31a8115a9f05a93423482fb213b34ee63d03f669acdb4895d1f4
                                                        • Instruction ID: 6d99b9644e0805d83b1fd23b10da4ffff103f19288e391e96407a1f11bc65c46
                                                        • Opcode Fuzzy Hash: 96dfbbe85f1f31a8115a9f05a93423482fb213b34ee63d03f669acdb4895d1f4
                                                        • Instruction Fuzzy Hash: A4519261A0C24A96CB157715DD053BA3BE8EB41745F307E5AE0D57A3F8EB308C82AA46
                                                        Function 00ECE187 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: #
                                                        • API String ID: 0-1885708031
                                                        • Opcode ID: 0ce7ffef8d2915fa1719ca237d2e30d924e6dd9181c2ea8495db8b870cccf4e6
                                                        • Instruction ID: 5298a87b017ff4aae061599e90a530a20bfa404d08a97e4c1585d74ea8a61c93
                                                        • Opcode Fuzzy Hash: 0ce7ffef8d2915fa1719ca237d2e30d924e6dd9181c2ea8495db8b870cccf4e6
                                                        • Instruction Fuzzy Hash: FC513675A00346DFDB29DF64C481BFA7BA8EF15320F245459ECA1AB2D0D6349D43EB90
                                                        Function 00ECF291 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • Sleep.KERNEL32(00000000), ref: 00ECF2A2
                                                        • GlobalMemoryStatusEx.KERNEL32(?), ref: 00ECF2BB
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: GlobalMemorySleepStatus
                                                        • String ID: @
                                                        • API String ID: 2783356886-2766056989
                                                        • Opcode ID: 67e97dd5be33ccf76507c4ec44e446f084a4c0fffe66bb423d011fc56163e525
                                                        • Instruction ID: e924c2b5a6ccdce6a8e82a053a51c9f7ea81944e73b2790c9324bd5228871f84
                                                        • Opcode Fuzzy Hash: 67e97dd5be33ccf76507c4ec44e446f084a4c0fffe66bb423d011fc56163e525
                                                        • Instruction Fuzzy Hash: A151467150C748ABD320AF10DC86BABBBF8FB84300F81985DF1D9911A5EB708529CB67
                                                        Function 00F35745 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CharUpperBuffW.USER32(?,?,?,00000003,?,?), ref: 00F357E0
                                                        • _wcslen.LIBCMT ref: 00F357EC
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: BuffCharUpper_wcslen
                                                        • String ID: CALLARGARRAY
                                                        • API String ID: 157775604-1150593374
                                                        • Opcode ID: 730cd8827568f5274d6c954ca2f3877448b6018c543f5771d47d427b1770b7c3
                                                        • Instruction ID: 733d7a1343a19242acbbc47a8b6945f5f904c3a293e4f7b5e7265c1d5e4ada7d
                                                        • Opcode Fuzzy Hash: 730cd8827568f5274d6c954ca2f3877448b6018c543f5771d47d427b1770b7c3
                                                        • Instruction Fuzzy Hash: 0F41AC71E002099FCB14DFA8C8829EEBBF5FF99730F105029E505A7292E7349D81DBA0
                                                        Function 00F2D0F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • _wcslen.LIBCMT ref: 00F2D130
                                                        • InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00F2D13A
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: CrackInternet_wcslen
                                                        • String ID: |
                                                        • API String ID: 596671847-2343686810
                                                        • Opcode ID: 6cf00a8526f6f1c630c0ac68910f84022a758bbba0f3e24e415d3068c268e64f
                                                        • Instruction ID: 2802270bf2ba63d3d6d25705ee9254ca982b66ff982cfa6eed9993ea823d10df
                                                        • Opcode Fuzzy Hash: 6cf00a8526f6f1c630c0ac68910f84022a758bbba0f3e24e415d3068c268e64f
                                                        • Instruction Fuzzy Hash: E2311871D00219ABDF15EFA4DC85AEFBFB9FF04310F100019E815B62A2E735AA16DB60
                                                        Function 00F4356C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • DestroyWindow.USER32(?,?,?,?), ref: 00F43621
                                                        • MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00F4365C
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Window$DestroyMove
                                                        • String ID: static
                                                        • API String ID: 2139405536-2160076837
                                                        • Opcode ID: 26d91f80e7b32c6d1b4c75603565906442067bb747abed1e015621defcad6c3b
                                                        • Instruction ID: 6637691342d484effcc2655121d5ab7d4b982e87659fd5ab3fab6abbf4bccac2
                                                        • Opcode Fuzzy Hash: 26d91f80e7b32c6d1b4c75603565906442067bb747abed1e015621defcad6c3b
                                                        • Instruction Fuzzy Hash: F531AD71500205AADB209F28DC81EFB77A9FF88720F019619FCA597280DA34AD81E760
                                                        Function 00F44537 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SendMessageW.USER32(00000027,00001132,00000000,?), ref: 00F4461F
                                                        • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00F44634
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: MessageSend
                                                        • String ID: '
                                                        • API String ID: 3850602802-1997036262
                                                        • Opcode ID: 66c467fe08c39e6146c70f8c0396c837473c222cc6abee785818fb628798dff9
                                                        • Instruction ID: 0ab3116fcd1d22663a23e1e24ef23ae62669d9e5dc5c977b5337887f83b7e30d
                                                        • Opcode Fuzzy Hash: 66c467fe08c39e6146c70f8c0396c837473c222cc6abee785818fb628798dff9
                                                        • Instruction Fuzzy Hash: 44313675A0120A9FDF14CFA9C981BEABBB5FF09300F15416AED04AB381E770A941DF90
                                                        Function 00F431EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00F4327C
                                                        • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00F43287
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: MessageSend
                                                        • String ID: Combobox
                                                        • API String ID: 3850602802-2096851135
                                                        • Opcode ID: 0af5c5f251f0ffc50c4b66cc9d38564d2a55e93590b75a377416c85481aaf530
                                                        • Instruction ID: c4851701b64dcfa500ed57a306efe16167a358c82dc90ff45e95dfb2a196b940
                                                        • Opcode Fuzzy Hash: 0af5c5f251f0ffc50c4b66cc9d38564d2a55e93590b75a377416c85481aaf530
                                                        • Instruction Fuzzy Hash: 2F11B2717002087FFF259E54DC81EFB3B6AEB943A4F104225FD18A7290D6B59E51A760
                                                        Function 00F43710 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EB600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00EB604C
                                                          • Part of subcall function 00EB600E: GetStockObject.GDI32(00000011), ref: 00EB6060
                                                          • Part of subcall function 00EB600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 00EB606A
                                                        • GetWindowRect.USER32(00000000,?), ref: 00F4377A
                                                        • GetSysColor.USER32(00000012), ref: 00F43794
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Window$ColorCreateMessageObjectRectSendStock
                                                        • String ID: static
                                                        • API String ID: 1983116058-2160076837
                                                        • Opcode ID: 5c1af9774b1458b8a87b4f4fa8f99edc94ffa0e490a815edd0e37e28c4b6e23d
                                                        • Instruction ID: 091f898a8ce2ff2bb79acfddbd16d7a02fe3b752736b6ab1742ae986297d8d06
                                                        • Opcode Fuzzy Hash: 5c1af9774b1458b8a87b4f4fa8f99edc94ffa0e490a815edd0e37e28c4b6e23d
                                                        • Instruction Fuzzy Hash: 1D1129B261020AAFDF10DFA8CC46AEA7BB8FB09354F005515FD95E2250E735E851AB50
                                                        Function 00F2CD1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00F2CD7D
                                                        • InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00F2CDA6
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Internet$OpenOption
                                                        • String ID: <local>
                                                        • API String ID: 942729171-4266983199
                                                        • Opcode ID: 7081119a02c0b3976bd5f9509bbcad883faf2b233476842f9be667a3ea954017
                                                        • Instruction ID: 2a5615bb580cfe9a9d76f374873f71c5f1400bb17fd2f7e56265c8f915baffed
                                                        • Opcode Fuzzy Hash: 7081119a02c0b3976bd5f9509bbcad883faf2b233476842f9be667a3ea954017
                                                        • Instruction Fuzzy Hash: 5C1106766016367AD7344B669C44FEBBE6CEF127B4F804226F52983080D3749844E6F1
                                                        Function 00F43429 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetWindowTextLengthW.USER32(00000000), ref: 00F434AB
                                                        • SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00F434BA
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: LengthMessageSendTextWindow
                                                        • String ID: edit
                                                        • API String ID: 2978978980-2167791130
                                                        • Opcode ID: 4c6b7d0a7fcfcfe8545f9269714a8d311c43e0d56ed6ccd55ac915bf4ba4975d
                                                        • Instruction ID: 5634d3192b375e6247fb6d77e7cb85da2ce431d78d124bc405dd2483dd71f7ce
                                                        • Opcode Fuzzy Hash: 4c6b7d0a7fcfcfe8545f9269714a8d311c43e0d56ed6ccd55ac915bf4ba4975d
                                                        • Instruction Fuzzy Hash: 81118C71600208ABEB229E64DC44AFB3BAAEB15374F504324FD65932E4C775ED91AB60
                                                        Function 00F16C86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EB9CB3: _wcslen.LIBCMT ref: 00EB9CBD
                                                        • CharUpperBuffW.USER32(?,?,?), ref: 00F16CB6
                                                        • _wcslen.LIBCMT ref: 00F16CC2
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: _wcslen$BuffCharUpper
                                                        • String ID: STOP
                                                        • API String ID: 1256254125-2411985666
                                                        • Opcode ID: d1381c8291202fbab28ee3bed4035c1db139e3b23d012c15d1e6179bc12f4f20
                                                        • Instruction ID: d89293f24d46cb53857a84300f6ab7f95b5eef067ecd494ae93e0e7946243ae8
                                                        • Opcode Fuzzy Hash: d1381c8291202fbab28ee3bed4035c1db139e3b23d012c15d1e6179bc12f4f20
                                                        • Instruction Fuzzy Hash: 7E01C432A005278BCB219FBDDC809FF77E5EA617207500525E852E6191EB31D980E690
                                                        Function 00F11CDE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EB9CB3: _wcslen.LIBCMT ref: 00EB9CBD
                                                          • Part of subcall function 00F13CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00F13CCA
                                                        • SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00F11D4C
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: ClassMessageNameSend_wcslen
                                                        • String ID: ComboBox$ListBox
                                                        • API String ID: 624084870-1403004172
                                                        • Opcode ID: 8fb7cb7c53a5a9d4b59faf778eab81f0b1f27db9004389280fbda517e6f597a2
                                                        • Instruction ID: 655cba63ae357f42cc2dbc570b15ff4d2290117354ec4a711746ca89eeca0f01
                                                        • Opcode Fuzzy Hash: 8fb7cb7c53a5a9d4b59faf778eab81f0b1f27db9004389280fbda517e6f597a2
                                                        • Instruction Fuzzy Hash: 23014C31A01218ABCB08EBA4DC51DFF77E8FF52360B10050AF936673C2EA305948E761
                                                        Function 00F11BD8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EB9CB3: _wcslen.LIBCMT ref: 00EB9CBD
                                                          • Part of subcall function 00F13CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00F13CCA
                                                        • SendMessageW.USER32(?,00000180,00000000,?), ref: 00F11C46
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: ClassMessageNameSend_wcslen
                                                        • String ID: ComboBox$ListBox
                                                        • API String ID: 624084870-1403004172
                                                        • Opcode ID: 58afdaadd1c6732d23390c02c81e60f2339bfd39c287b30524ab6f57fddf2681
                                                        • Instruction ID: 6c9db5478e042ba05d30bee224f100aa6375e06a62b0f55661e04c5aceb29e99
                                                        • Opcode Fuzzy Hash: 58afdaadd1c6732d23390c02c81e60f2339bfd39c287b30524ab6f57fddf2681
                                                        • Instruction Fuzzy Hash: 1D01A775B8110867CB08EB90DD51EFFB7E8AB51340F141019AA0677282EA649E48AAF2
                                                        Function 00F11C5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EB9CB3: _wcslen.LIBCMT ref: 00EB9CBD
                                                          • Part of subcall function 00F13CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00F13CCA
                                                        • SendMessageW.USER32(?,00000182,?,00000000), ref: 00F11CC8
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: ClassMessageNameSend_wcslen
                                                        • String ID: ComboBox$ListBox
                                                        • API String ID: 624084870-1403004172
                                                        • Opcode ID: d04ddf4d18507cda1d40ed0ebca3e74fd74f0caa5352416e9206669b983fb380
                                                        • Instruction ID: 6cd640639a43e0fa88c110d2433082fc4547493eb33396b98cf912df094a4e07
                                                        • Opcode Fuzzy Hash: d04ddf4d18507cda1d40ed0ebca3e74fd74f0caa5352416e9206669b983fb380
                                                        • Instruction Fuzzy Hash: B701DB75B4111C67CF04E794CE51AFF77E8AB11340F241015B90673282EA649F48E6F2
                                                        Function 00F11D68 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00EB9CB3: _wcslen.LIBCMT ref: 00EB9CBD
                                                          • Part of subcall function 00F13CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00F13CCA
                                                        • SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 00F11DD3
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: ClassMessageNameSend_wcslen
                                                        • String ID: ComboBox$ListBox
                                                        • API String ID: 624084870-1403004172
                                                        • Opcode ID: f431cc93d50d7500c4d2c6d312948371c858caa2647c72c4ab954ea8c7f1ac59
                                                        • Instruction ID: 760a4276d202f06bd8b3faeb8dfb45d464ea228e70b1a1f03f2f0bfc4f9dab3a
                                                        • Opcode Fuzzy Hash: f431cc93d50d7500c4d2c6d312948371c858caa2647c72c4ab954ea8c7f1ac59
                                                        • Instruction Fuzzy Hash: 70F02D71B4121867CB04F7A4DC51FFF77F8BB01350F140915B926732C2EA64590896A1
                                                        Function 00F3747E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: _wcslen
                                                        • String ID: 3, 3, 16, 1
                                                        • API String ID: 176396367-3042988571
                                                        • Opcode ID: e0cadb0dccf189067faa248c9153d71ef7353e7b66a2ee388e3a4a1412b1b87c
                                                        • Instruction ID: 0068207d57ff40d8695faad291be393d413ff547372ed9056e057bc3e552d91d
                                                        • Opcode Fuzzy Hash: e0cadb0dccf189067faa248c9153d71ef7353e7b66a2ee388e3a4a1412b1b87c
                                                        • Instruction Fuzzy Hash: 2EE023816143119153313376DCC157F56C9CFD9770B10141BF985D1396E694DD9263A1
                                                        Function 00F10B15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00F10B23
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Message
                                                        • String ID: AutoIt$Error allocating memory.
                                                        • API String ID: 2030045667-4017498283
                                                        • Opcode ID: 6825bda146a3d0c498ea1858e10452419e708697d7fb99d8fd6b05b1242a2f06
                                                        • Instruction ID: f1eb87626073f4ecf8d1923ecafc78d6c497fc86e29e8f907e9ff4b672d525df
                                                        • Opcode Fuzzy Hash: 6825bda146a3d0c498ea1858e10452419e708697d7fb99d8fd6b05b1242a2f06
                                                        • Instruction Fuzzy Hash: 94E092312853183BD21026947C03F897FC48B05B20F10542BFB48A55C38AE2649026EA
                                                        Function 00ED0D42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00ECF7C9: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00ED0D71,?,?,?,00EB100A), ref: 00ECF7CE
                                                        • IsDebuggerPresent.KERNEL32(?,?,?,00EB100A), ref: 00ED0D75
                                                        • OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00EB100A), ref: 00ED0D84
                                                        Strings
                                                        • ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00ED0D7F
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
                                                        • String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
                                                        • API String ID: 55579361-631824599
                                                        • Opcode ID: 76979728f47ac605d598572ed10bc26ac538c3ca805630749e3b59c00246fe84
                                                        • Instruction ID: b9e17ab8cdbc39467a3cd5fb9e0351fb3f937908a31350b2879cc06e205b0f61
                                                        • Opcode Fuzzy Hash: 76979728f47ac605d598572ed10bc26ac538c3ca805630749e3b59c00246fe84
                                                        • Instruction Fuzzy Hash: A1E06D742003018BD3609FB8E4047827BE5EB14745F04592EE886D6752DBF1E5499BA1
                                                        Function 00F23017 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetTempPathW.KERNEL32(00000104,?,00000001), ref: 00F2302F
                                                        • GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 00F23044
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: Temp$FileNamePath
                                                        • String ID: aut
                                                        • API String ID: 3285503233-3010740371
                                                        • Opcode ID: 0257aa8ad770440592f8d33110d13b3097e7c5168bf6b5272d5befb49a0a47ec
                                                        • Instruction ID: 494c52ccb668f0ea3c8ec3b73d2ceec920fe15aa931d127035195cc80bdbacf6
                                                        • Opcode Fuzzy Hash: 0257aa8ad770440592f8d33110d13b3097e7c5168bf6b5272d5befb49a0a47ec
                                                        • Instruction Fuzzy Hash: 3CD05E7650132867DA60A7A4AC0EFCB3A6CDB05750F0002A2BA55E2091DAF4DA84CAD5
                                                        Function 00F0D21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: LocalTime
                                                        • String ID: %.3d$X64
                                                        • API String ID: 481472006-1077770165
                                                        • Opcode ID: e0a513effc16b45b57c9b3df6c8596921149475aba4f8bb9aa99870851e67f6c
                                                        • Instruction ID: b9b6a18a9ede6d901494e46737859e325cdd1c99c15a4e237112422f24a32e37
                                                        • Opcode Fuzzy Hash: e0a513effc16b45b57c9b3df6c8596921149475aba4f8bb9aa99870851e67f6c
                                                        • Instruction Fuzzy Hash: EFD01262809218EACB9096D0CD45EB9B3BCEB19301F508466FC0AA1080D735C5097B62
                                                        Function 00F42356 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00F4236C
                                                        • PostMessageW.USER32(00000000), ref: 00F42373
                                                          • Part of subcall function 00F1E97B: Sleep.KERNEL32 ref: 00F1E9F3
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: FindMessagePostSleepWindow
                                                        • String ID: Shell_TrayWnd
                                                        • API String ID: 529655941-2988720461
                                                        • Opcode ID: 74c8fbc774c661df17cc8050b8f1f9d848bcc1da993806e58b59836e24c81454
                                                        • Instruction ID: 06752dac8c351376f928a9efbd83340b2de6b2f50bad091701bd2ece14ba168a
                                                        • Opcode Fuzzy Hash: 74c8fbc774c661df17cc8050b8f1f9d848bcc1da993806e58b59836e24c81454
                                                        • Instruction Fuzzy Hash: 43D022363C23007BE2A8B330DC0FFCA76149B11B00F0089067B0AEA0D0C8F0B801DA84
                                                        Function 00F42322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00F4232C
                                                        • PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00F4233F
                                                          • Part of subcall function 00F1E97B: Sleep.KERNEL32 ref: 00F1E9F3
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: FindMessagePostSleepWindow
                                                        • String ID: Shell_TrayWnd
                                                        • API String ID: 529655941-2988720461
                                                        • Opcode ID: 74b35a4587939df5d7e9844b6251bbfc6402b6761c4d32be7bf06adf007b18c8
                                                        • Instruction ID: 390f5613230a9ac27bee0aed1e5edb522e5b6d52b22020a86e6719068735319f
                                                        • Opcode Fuzzy Hash: 74b35a4587939df5d7e9844b6251bbfc6402b6761c4d32be7bf06adf007b18c8
                                                        • Instruction Fuzzy Hash: 30D0223A381300B7E2A8B330DC0FFCA7A149B10B00F0089067B0AEA0D0C8F0A801DA80
                                                        Function 00EEBDFD Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 00EEBE93
                                                        • GetLastError.KERNEL32 ref: 00EEBEA1
                                                        • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00EEBEFC
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2964351488.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                                        • Associated: 00000000.00000002.2964335212.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F4C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964411407.0000000000F72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964465828.0000000000F7C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2964488044.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_eb0000_file.jbxd
                                                        Similarity
                                                        • API ID: ByteCharMultiWide$ErrorLast
                                                        • String ID:
                                                        • API String ID: 1717984340-0
                                                        • Opcode ID: 5fc50560cbf18e028edc02dce6c58e82074dba6ff1fea3d789f85748f0476b45
                                                        • Instruction ID: 0c1c501bd3fe4d4bf5b9b7c4c60960108c85bcf7c1ecb971dc6a1c0ede92788d
                                                        • Opcode Fuzzy Hash: 5fc50560cbf18e028edc02dce6c58e82074dba6ff1fea3d789f85748f0476b45
                                                        • Instruction Fuzzy Hash: B841FA3470128EAFCF218FA6DC44ABB7BA5EF41314F146169F959B72A1DB308D01DBA0